Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec

Steffen Klassert says:

====================
pull request (net): ipsec 2022-08-24

1) Fix a refcount leak in __xfrm_policy_check.
   From Xin Xiong.

2) Revert "xfrm: update SA curlft.use_time". This
   violates RFC 2367. From Antony Antony.

3) Fix a comment on XFRMA_LASTUSED.
   From Antony Antony.

4) x->lastused is not cloned in xfrm_do_migrate.
   Fix from Antony Antony.

5) Serialize the calls to xfrm_probe_algs.
   From Herbert Xu.

6) Fix a null pointer dereference of dst->dev on a metadata
   dst in xfrm_lookup_with_ifid. From Nikolay Aleksandrov.

Please pull or let me know if there are problems.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --combined include/uapi/linux/xfrm.h
index b1f3e6a8f11a16dee683c295350c3aa89be61984,a9f5d884560acc94076df8414d785eae5a7b96af..4f84ea7ee14c902ee473a843af97b396009e0a04
--- 1/include/uapi/linux/xfrm.h
--- 2/include/uapi/linux/xfrm.h
+++ b/include/uapi/linux/xfrm.h
@@@ -33,7 -33,7 +33,7 @@@ struct xfrm_sec_ctx 
        __u8    ctx_alg;
        __u16   ctx_len;
        __u32   ctx_sid;
 -      char    ctx_str[0];
 +      char    ctx_str[];
  };
  
  /* Security Context Domains of Interpretation */
@@@ -96,27 -96,27 +96,27 @@@ struct xfrm_replay_state_esn 
        __u32           oseq_hi;
        __u32           seq_hi;
        __u32           replay_window;
 -      __u32           bmp[0];
 +      __u32           bmp[];
  };
  
  struct xfrm_algo {
        char            alg_name[64];
        unsigned int    alg_key_len;    /* in bits */
 -      char            alg_key[0];
 +      char            alg_key[];
  };
  
  struct xfrm_algo_auth {
        char            alg_name[64];
        unsigned int    alg_key_len;    /* in bits */
        unsigned int    alg_trunc_len;  /* in bits */
 -      char            alg_key[0];
 +      char            alg_key[];
  };
  
  struct xfrm_algo_aead {
        char            alg_name[64];
        unsigned int    alg_key_len;    /* in bits */
        unsigned int    alg_icv_len;    /* in bits */
 -      char            alg_key[0];
 +      char            alg_key[];
  };
  
  struct xfrm_stats {
@@@ -296,7 -296,7 +296,7 @@@ enum xfrm_attr_type_t 
        XFRMA_ETIMER_THRESH,
        XFRMA_SRCADDR,          /* xfrm_address_t */
        XFRMA_COADDR,           /* xfrm_address_t */
-       XFRMA_LASTUSED,         /* unsigned long  */
+       XFRMA_LASTUSED,         /* __u64 */
        XFRMA_POLICY_TYPE,      /* struct xfrm_userpolicy_type */
        XFRMA_MIGRATE,
        XFRMA_ALG_AEAD,         /* struct xfrm_algo_aead */
@@@ -511,9 -511,9 +511,9 @@@ struct xfrm_user_offload 
        int                             ifindex;
        __u8                            flags;
  };
 -/* This flag was exposed without any kernel code that supporting it.
 - * Unfortunately, strongswan has the code that uses sets this flag,
 - * which makes impossible to reuse this bit.
 +/* This flag was exposed without any kernel code that supports it.
 + * Unfortunately, strongswan has the code that sets this flag,
 + * which makes it impossible to reuse this bit.
   *
   * So leave it here to make sure that it won't be reused by mistake.
   */

diff --combined net/key/af_key.c
index fda2dcc8a3831b46e57d361b59988a78b71271d4,20e73643b9c89846f81c6d84f41b08fa525149e3..c85df5b958d266ce37fb27caba1bad74e8ef70a7
--- 1/net/key/af_key.c
--- 2/net/key/af_key.c
+++ b/net/key/af_key.c
@@@ -1697,9 -1697,12 +1697,12 @@@ static int pfkey_register(struct sock *
                pfk->registered |= (1<<hdr->sadb_msg_satype);
        }
  
+       mutex_lock(&pfkey_mutex);
        xfrm_probe_algs();
  
        supp_skb = compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO);
+       mutex_unlock(&pfkey_mutex);
+ 
        if (!supp_skb) {
                if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC)
                        pfk->registered &= ~(1<<hdr->sadb_msg_satype);
@@@ -3894,10 -3897,14 +3897,10 @@@ static int __init ipsec_pfkey_init(void
        err = sock_register(&pfkey_family_ops);
        if (err != 0)
                goto out_unregister_pernet;
 -      err = xfrm_register_km(&pfkeyv2_mgr);
 -      if (err != 0)
 -              goto out_sock_unregister;
 +      xfrm_register_km(&pfkeyv2_mgr);
  out:
        return err;
  
 -out_sock_unregister:
 -      sock_unregister(PF_KEY);
  out_unregister_pernet:
        unregister_pernet_subsys(&pfkey_net_ops);
  out_unregister_key_proto:

diff --combined net/xfrm/xfrm_state.c
index 52e60e607f8ad5ff446ab4cc6ccba9d14acb43c7,11d89af9cb55a3e9a600ba532a44fb354d3877b5..91c32a3b692497fb2200b3b3c54a990a90c21c2d
--- 1/net/xfrm/xfrm_state.c
--- 2/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@@ -1592,6 -1592,7 +1592,7 @@@ static struct xfrm_state *xfrm_state_cl
        x->replay = orig->replay;
        x->preplay = orig->preplay;
        x->mapping_maxage = orig->mapping_maxage;
+       x->lastused = orig->lastused;
        x->new_mapping = 0;
        x->new_mapping_sport = 0;
  
@@@ -2481,20 -2482,22 +2482,20 @@@ EXPORT_SYMBOL(xfrm_user_policy)
  
  static DEFINE_SPINLOCK(xfrm_km_lock);
  
 -int xfrm_register_km(struct xfrm_mgr *km)
 +void xfrm_register_km(struct xfrm_mgr *km)
  {
        spin_lock_bh(&xfrm_km_lock);
        list_add_tail_rcu(&km->list, &xfrm_km_list);
        spin_unlock_bh(&xfrm_km_lock);
 -      return 0;
  }
  EXPORT_SYMBOL(xfrm_register_km);
  
 -int xfrm_unregister_km(struct xfrm_mgr *km)
 +void xfrm_unregister_km(struct xfrm_mgr *km)
  {
        spin_lock_bh(&xfrm_km_lock);
        list_del_rcu(&km->list);
        spin_unlock_bh(&xfrm_km_lock);
        synchronize_rcu();
 -      return 0;
  }
  EXPORT_SYMBOL(xfrm_unregister_km);