xfrm: Fix the usage of skb->sk

xfrm assumed to always have a full socket at skb->sk.
This is not always true, so fix it by converting to a
full socket before it is used.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index f3281312eb5eba53110e8276184703eab6bc81e8..8cf5f6634775f3ab24e2296126406416f5381be3 100644 (file)
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -279,7 +279,7 @@ static void esp_output_done(void *data, int err)
                    x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
                        esp_output_tail_tcp(x, skb);
                else
-                       xfrm_output_resume(skb->sk, skb, err);
+                       xfrm_output_resume(skb_to_full_sk(skb), skb, err);
        }
 }
 

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index b2400c226a32582641407e7ed7beecb681d05a9e..fad4d7c9fa5024961bd0359e755da8607478cc03 100644 (file)
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -315,7 +315,7 @@ static void esp_output_done(void *data, int err)
                    x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
                        esp_output_tail_tcp(x, skb);
                else
-                       xfrm_output_resume(skb->sk, skb, err);
+                       xfrm_output_resume(skb_to_full_sk(skb), skb, err);
        }
 }
 

diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 5f7b1fdbffe621da317d07ce39514eb8e137bc65..b3d5d1f266eeea6bea32d81feede4c1076f2f829 100644 (file)
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -82,14 +82,14 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 
        toobig = skb->len > mtu && !skb_is_gso(skb);
 
-       if (toobig && xfrm6_local_dontfrag(skb->sk)) {
+       if (toobig && xfrm6_local_dontfrag(sk)) {
                xfrm6_local_rxpmtu(skb, mtu);
                kfree_skb(skb);
                return -EMSGSIZE;
        } else if (toobig && xfrm6_noneed_fragment(skb)) {
                skb->ignore_df = 1;
                goto skip_frag;
-       } else if (!skb->ignore_df && toobig && skb->sk) {
+       } else if (!skb->ignore_df && toobig && sk) {
                xfrm_local_error(skb, mtu);
                kfree_skb(skb);
                return -EMSGSIZE;

diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c
index 98f1e2b67c76b3e65b32b10b50cc9da9494ac52c..c397eb99d867918516401bf2e158b9c438b8eb3f 100644 (file)
--- a/net/xfrm/xfrm_interface_core.c
+++ b/net/xfrm/xfrm_interface_core.c
@@ -506,7 +506,7 @@ xmit:
        skb_dst_set(skb, dst);
        skb->dev = tdev;
 
-       err = dst_output(xi->net, skb->sk, skb);
+       err = dst_output(xi->net, skb_to_full_sk(skb), skb);
        if (net_xmit_eval(err) == 0) {
                dev_sw_netstats_tx_add(dev, 1, length);
        } else {

diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index e5722c95b8bb38c528cc518cdc3a05e08a338264..1fb4dc0a76e1347369d5453083fbf0d4419c6c8d 100644 (file)
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -796,7 +796,7 @@ static int xfrm4_tunnel_check_size(struct sk_buff *skb)
             !skb_gso_validate_network_len(skb, ip_skb_dst_mtu(skb->sk, skb)))) {
                skb->protocol = htons(ETH_P_IP);
 
-               if (skb->sk)
+               if (skb->sk && sk_fullsock(skb->sk))
                        xfrm_local_error(skb, mtu);
                else
                        icmp_send(skb, ICMP_DEST_UNREACH,
@@ -832,6 +832,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
 {
        int mtu, ret = 0;
        struct dst_entry *dst = skb_dst(skb);
+       struct sock *sk = skb_to_full_sk(skb);
 
        if (skb->ignore_df)
                goto out;
@@ -846,9 +847,9 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
                skb->dev = dst->dev;
                skb->protocol = htons(ETH_P_IPV6);
 
-               if (xfrm6_local_dontfrag(skb->sk))
+               if (xfrm6_local_dontfrag(sk))
                        ipv6_stub->xfrm6_local_rxpmtu(skb, mtu);
-               else if (skb->sk)
+               else if (sk)
                        xfrm_local_error(skb, mtu);
                else
                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 4408c11c0835f96aa7f1749797e4b725dd7c147b..c27da1fd070ec869be97d9bba5b5e2e4a787fa51 100644 (file)
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2959,7 +2959,7 @@ static void xfrm_policy_queue_process(struct timer_list *t)
                skb_dst_drop(skb);
                skb_dst_set(skb, dst);
 
-               dst_output(net, skb->sk, skb);
+               dst_output(net, skb_to_full_sk(skb), skb);
        }
 
 out: