xfrm: pass struct net to xfrm_decode_session wrappers

Preparation patch, extra arg is not used.
No functional changes intended.

This is needed to replace the xfrm session decode functions with
the flow dissector.

skb_flow_dissect() cannot be used as-is, because it attempts to deduce the
'struct net' to use for bpf program fetch from skb->sk or skb->dev, but
xfrm code path can see skbs that have neither sk or dev filled in.

So either flow dissector needs to try harder, e.g. by also trying
skb->dst->dev, or we have to pass the struct net explicitly.

Passing the struct net doesn't look too bad to me, most places
already have it available or can derive it from the output device.

Reported-by: kernel test robot <oliver.sang@intel.com>
Link: https://lore.kernel.org/netdev/202309271628.27fd2187-oliver.sang@intel.com/
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 4681ecfb85ac2697c233050b43878ea49d044175..c9bb0f892f55595bc41d1394104ff3d06a0d48bd 100644 (file)
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1207,20 +1207,20 @@ static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
        return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
 }
 
-int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
+int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl,
                          unsigned int family, int reverse);
 
-static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
+static inline int xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl,
                                      unsigned int family)
 {
-       return __xfrm_decode_session(skb, fl, family, 0);
+       return __xfrm_decode_session(net, skb, fl, family, 0);
 }
 
-static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
+static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb,
                                              struct flowi *fl,
                                              unsigned int family)
 {
-       return __xfrm_decode_session(skb, fl, family, 1);
+       return __xfrm_decode_session(net, skb, fl, family, 1);
 }
 
 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
@@ -1296,7 +1296,7 @@ static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *sk
 {
        return 1;
 }
-static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
+static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb,
                                              struct flowi *fl,
                                              unsigned int family)
 {

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index b8607763d113a5878181ffd17a36a3ea4261ca55..e63a3bf99617627e17669f9b3aaee1cbbf178ebf 100644 (file)
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -517,7 +517,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
        } else
                return rt;
 
-       err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(&fl4_dec), AF_INET);
+       err = xfrm_decode_session_reverse(net, skb_in, flowi4_to_flowi(&fl4_dec), AF_INET);
        if (err)
                goto relookup_failed;
 

diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index d1e7d0ceb7edd464859c9768912d9b132bd36365..9ab9b3ebe0cd1a9e95f489d98c5a3d89c7c0edf6 100644 (file)
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -288,11 +288,11 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
        switch (skb->protocol) {
        case htons(ETH_P_IP):
                memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
-               xfrm_decode_session(skb, &fl, AF_INET);
+               xfrm_decode_session(dev_net(dev), skb, &fl, AF_INET);
                break;
        case htons(ETH_P_IPV6):
                memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
-               xfrm_decode_session(skb, &fl, AF_INET6);
+               xfrm_decode_session(dev_net(dev), skb, &fl, AF_INET6);
                break;
        default:
                goto tx_err;

diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index bd135165482aadc63947170d9375d5538342f731..591a2737808e4786013b34196f92f35632474f3c 100644 (file)
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -62,7 +62,7 @@ int ip_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb, un
 
 #ifdef CONFIG_XFRM
        if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
-           xfrm_decode_session(skb, flowi4_to_flowi(&fl4), AF_INET) == 0) {
+           xfrm_decode_session(net, skb, flowi4_to_flowi(&fl4), AF_INET) == 0) {
                struct dst_entry *dst = skb_dst(skb);
                skb_dst_set(skb, NULL);
                dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), sk, 0);

diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 8fb4a791881a48d5efcebc990c8829d8f77fe94f..f62427097126984214e0c757b935eea5418ce541 100644 (file)
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -385,7 +385,7 @@ static struct dst_entry *icmpv6_route_lookup(struct net *net,
                        return dst;
        }
 
-       err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6);
+       err = xfrm_decode_session_reverse(net, skb, flowi6_to_flowi(&fl2), AF_INET6);
        if (err)
                goto relookup_failed;
 

diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 73c85d4e0e9cd5e97943e4d6fb8bd99458e1ee46..e550240c85e1c9f2fe2b835e903de28e1f08b3bc 100644 (file)
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -569,11 +569,11 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                        goto tx_err;
 
                memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
-               xfrm_decode_session(skb, &fl, AF_INET6);
+               xfrm_decode_session(dev_net(dev), skb, &fl, AF_INET6);
                break;
        case htons(ETH_P_IP):
                memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
-               xfrm_decode_session(skb, &fl, AF_INET);
+               xfrm_decode_session(dev_net(dev), skb, &fl, AF_INET);
                break;
        default:
                goto tx_err;

diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 857713d7a38a54182b7b73dbd337cf8a8f03b74f..53d255838e6ab5f8ac4985c6d824966c3475ec97 100644 (file)
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -61,7 +61,7 @@ int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff
 
 #ifdef CONFIG_XFRM
        if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
-           xfrm_decode_session(skb, flowi6_to_flowi(&fl6), AF_INET6) == 0) {
+           xfrm_decode_session(net, skb, flowi6_to_flowi(&fl6), AF_INET6) == 0) {
                skb_dst_set(skb, NULL);
                dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
                if (IS_ERR(dst))

diff --git a/net/netfilter/nf_nat_proto.c b/net/netfilter/nf_nat_proto.c
index 48cc60084d28b35ef3801ca64993d85fd4e27367..c77963517bf87aa6e223eea20af291e779cf81d7 100644 (file)
--- a/net/netfilter/nf_nat_proto.c
+++ b/net/netfilter/nf_nat_proto.c
@@ -668,7 +668,7 @@ static int nf_xfrm_me_harder(struct net *net, struct sk_buff *skb, unsigned int
        struct flowi fl;
        int err;
 
-       err = xfrm_decode_session(skb, &fl, family);
+       err = xfrm_decode_session(net, skb, &fl, family);
        if (err < 0)
                return err;
 

diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c
index b864740846902db7f0ab60c6d72465a51b96b1d7..656f437f5f5317bf96bfb36de8d99ab5ab8ec6f5 100644 (file)
--- a/net/xfrm/xfrm_interface_core.c
+++ b/net/xfrm/xfrm_interface_core.c
@@ -538,7 +538,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
        switch (skb->protocol) {
        case htons(ETH_P_IPV6):
                memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
-               xfrm_decode_session(skb, &fl, AF_INET6);
+               xfrm_decode_session(dev_net(dev), skb, &fl, AF_INET6);
                if (!dst) {
                        fl.u.ip6.flowi6_oif = dev->ifindex;
                        fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
@@ -553,7 +553,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
                break;
        case htons(ETH_P_IP):
                memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
-               xfrm_decode_session(skb, &fl, AF_INET);
+               xfrm_decode_session(dev_net(dev), skb, &fl, AF_INET);
                if (!dst) {
                        struct rtable *rt;
 

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index c4c4fc29ccf5a264866ea42b80acd83e2af6562f..064d1744fa362bf5b962d5d341f9379cf6c7fbfc 100644 (file)
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2853,7 +2853,7 @@ static void xfrm_policy_queue_process(struct timer_list *t)
        /* Fixup the mark to support VTI. */
        skb_mark = skb->mark;
        skb->mark = pol->mark.v;
-       xfrm_decode_session(skb, &fl, dst->ops->family);
+       xfrm_decode_session(net, skb, &fl, dst->ops->family);
        skb->mark = skb_mark;
        spin_unlock(&pq->hold_queue.lock);
 
@@ -2889,7 +2889,7 @@ static void xfrm_policy_queue_process(struct timer_list *t)
                /* Fixup the mark to support VTI. */
                skb_mark = skb->mark;
                skb->mark = pol->mark.v;
-               xfrm_decode_session(skb, &fl, skb_dst(skb)->ops->family);
+               xfrm_decode_session(net, skb, &fl, skb_dst(skb)->ops->family);
                skb->mark = skb_mark;
 
                dst_hold(xfrm_dst_path(skb_dst(skb)));
@@ -3554,7 +3554,7 @@ decode_session6(struct sk_buff *skb, struct flowi *fl, bool reverse)
 }
 #endif
 
-int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
+int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl,
                          unsigned int family, int reverse)
 {
        switch (family) {
@@ -3618,7 +3618,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
        reverse = dir & ~XFRM_POLICY_MASK;
        dir &= XFRM_POLICY_MASK;
 
-       if (__xfrm_decode_session(skb, &fl, family, reverse) < 0) {
+       if (__xfrm_decode_session(net, skb, &fl, family, reverse) < 0) {
                XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
                return 0;
        }
@@ -3774,7 +3774,7 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
        struct dst_entry *dst;
        int res = 1;
 
-       if (xfrm_decode_session(skb, &fl, family) < 0) {
+       if (xfrm_decode_session(net, skb, &fl, family) < 0) {
                XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR);
                return 0;
        }