[XFRM] user: Move attribute copying code into copy_to_user_state_extra

[linux-2.6] / net / xfrm / xfrm_user.c

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 0d81c0f2391920799316a313a8c1ff3051574910..2cbbe5e93a7bb5ecdc59653378435d97cc32fa60 100644 (file)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -483,9 +483,9 @@ struct xfrm_dump_info {
 
 static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
 {
-       int ctx_size = sizeof(struct xfrm_sec_ctx) + s->ctx_len;
        struct xfrm_user_sec_ctx *uctx;
        struct nlattr *attr;
+       int ctx_size = sizeof(*uctx) + s->ctx_len;
 
        attr = nla_reserve(skb, XFRMA_SEC_CTX, ctx_size);
        if (attr == NULL)
@@ -502,23 +502,11 @@ static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
        return 0;
 }
 
-static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
+/* Don't change this without updating xfrm_sa_len! */
+static int copy_to_user_state_extra(struct xfrm_state *x,
+                                   struct xfrm_usersa_info *p,
+                                   struct sk_buff *skb)
 {
-       struct xfrm_dump_info *sp = ptr;
-       struct sk_buff *in_skb = sp->in_skb;
-       struct sk_buff *skb = sp->out_skb;
-       struct xfrm_usersa_info *p;
-       struct nlmsghdr *nlh;
-
-       if (sp->this_idx < sp->start_idx)
-               goto out;
-
-       nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
-                       XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
-       if (nlh == NULL)
-               return -EMSGSIZE;
-
-       p = nlmsg_data(nlh);
        copy_to_user_state(x, p);
 
        if (x->aalg)
@@ -540,6 +528,35 @@ static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
        if (x->lastused)
                NLA_PUT_U64(skb, XFRMA_LASTUSED, x->lastused);
 
+       return 0;
+
+nla_put_failure:
+       return -EMSGSIZE;
+}
+
+static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
+{
+       struct xfrm_dump_info *sp = ptr;
+       struct sk_buff *in_skb = sp->in_skb;
+       struct sk_buff *skb = sp->out_skb;
+       struct xfrm_usersa_info *p;
+       struct nlmsghdr *nlh;
+       int err;
+
+       if (sp->this_idx < sp->start_idx)
+               goto out;
+
+       nlh = nlmsg_put(skb, NETLINK_CB(in_skb).pid, sp->nlmsg_seq,
+                       XFRM_MSG_NEWSA, sizeof(*p), sp->nlmsg_flags);
+       if (nlh == NULL)
+               return -EMSGSIZE;
+
+       p = nlmsg_data(nlh);
+
+       err = copy_to_user_state_extra(x, p, skb);
+       if (err)
+               goto nla_put_failure;
+
        nlmsg_end(skb, nlh);
 out:
        sp->this_idx++;
@@ -547,7 +564,7 @@ out:
 
 nla_put_failure:
        nlmsg_cancel(skb, nlh);
-       return -EMSGSIZE;
+       return err;
 }
 
 static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
@@ -784,16 +801,11 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
        if (x == NULL)
                goto out_noput;
 
-       resp_skb = ERR_PTR(-ENOENT);
-
-       spin_lock_bh(&x->lock);
-       if (x->km.state != XFRM_STATE_DEAD) {
-               xfrm_alloc_spi(x, htonl(p->min), htonl(p->max));
-               if (x->id.spi)
-                       resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
-       }
-       spin_unlock_bh(&x->lock);
+       err = xfrm_alloc_spi(x, p->min, p->max);
+       if (err)
+               goto out;
 
+       resp_skb = xfrm_state_netlink(skb, x, nlh->nlmsg_seq);
        if (IS_ERR(resp_skb)) {
                err = PTR_ERR(resp_skb);
                goto out;
@@ -1887,7 +1899,7 @@ static void xfrm_netlink_rcv(struct sock *sk, int len)
 
        do {
                mutex_lock(&xfrm_cfg_mutex);
-               netlink_run_queue(sk, &qlen, &xfrm_user_rcv_msg);
+               qlen = netlink_run_queue(sk, qlen, &xfrm_user_rcv_msg);
                mutex_unlock(&xfrm_cfg_mutex);
 
        } while (qlen);
@@ -1978,6 +1990,14 @@ static inline size_t xfrm_sa_len(struct xfrm_state *x)
                l += nla_total_size(sizeof(*x->calg));
        if (x->encap)
                l += nla_total_size(sizeof(*x->encap));
+       if (x->security)
+               l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
+                                   x->security->ctx_len);
+       if (x->coaddr)
+               l += nla_total_size(sizeof(*x->coaddr));
+
+       /* Must count this as this may become non-zero behind our back. */
+       l += nla_total_size(sizeof(x->lastused));
 
        return l;
 }
@@ -2023,23 +2043,16 @@ static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c)
                p = nla_data(attr);
        }
 
-       copy_to_user_state(x, p);
-
-       if (x->aalg)
-               NLA_PUT(skb, XFRMA_ALG_AUTH, alg_len(x->aalg), x->aalg);
-       if (x->ealg)
-               NLA_PUT(skb, XFRMA_ALG_CRYPT, alg_len(x->ealg), x->ealg);
-       if (x->calg)
-               NLA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
-
-       if (x->encap)
-               NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
+       if (copy_to_user_state_extra(x, p, skb))
+               goto nla_put_failure;
 
        nlmsg_end(skb, nlh);
 
        return nlmsg_multicast(xfrm_nl, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
 
 nla_put_failure:
+       /* Somebody screwed up with xfrm_sa_len! */
+       WARN_ON(1);
        kfree_skb(skb);
        return -1;
 }
@@ -2399,7 +2412,7 @@ static int __init xfrm_user_init(void)
 
        printk(KERN_INFO "Initializing XFRM netlink socket\n");
 
-       nlsk = netlink_kernel_create(NETLINK_XFRM, XFRMNLGRP_MAX,
+       nlsk = netlink_kernel_create(&init_net, NETLINK_XFRM, XFRMNLGRP_MAX,
                                     xfrm_netlink_rcv, NULL, THIS_MODULE);
        if (nlsk == NULL)
                return -ENOMEM;