Patch Detail

HTTP 200 OK
Allow: GET, PUT, PATCH, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 833407,
    "url": "http://patchwork.ozlabs.org/api/1.2/patches/833407/?format=api",
    "web_url": "http://patchwork.ozlabs.org/project/netdev/patch/20171102154601.25590-1-fw@strlen.de/",
    "project": {
        "id": 7,
        "url": "http://patchwork.ozlabs.org/api/1.2/projects/7/?format=api",
        "name": "Linux network development",
        "link_name": "netdev",
        "list_id": "netdev.vger.kernel.org",
        "list_email": "netdev@vger.kernel.org",
        "web_url": null,
        "scm_url": null,
        "webscm_url": null,
        "list_archive_url": "",
        "list_archive_url_format": "",
        "commit_url_format": ""
    },
    "msgid": "<20171102154601.25590-1-fw@strlen.de>",
    "list_archive_url": null,
    "date": "2017-11-02T15:46:01",
    "name": "[ipsec] xfrm: do unconditional template resolution before pcpu cache check",
    "commit_ref": null,
    "pull_url": null,
    "state": "awaiting-upstream",
    "archived": true,
    "hash": "08dd17a4f41889dbc67b74cabda81f3bee5287ac",
    "submitter": {
        "id": 1025,
        "url": "http://patchwork.ozlabs.org/api/1.2/people/1025/?format=api",
        "name": "Florian Westphal",
        "email": "fw@strlen.de"
    },
    "delegate": {
        "id": 34,
        "url": "http://patchwork.ozlabs.org/api/1.2/users/34/?format=api",
        "username": "davem",
        "first_name": "David",
        "last_name": "Miller",
        "email": "davem@davemloft.net"
    },
    "mbox": "http://patchwork.ozlabs.org/project/netdev/patch/20171102154601.25590-1-fw@strlen.de/mbox/",
    "series": [
        {
            "id": 11534,
            "url": "http://patchwork.ozlabs.org/api/1.2/series/11534/?format=api",
            "web_url": "http://patchwork.ozlabs.org/project/netdev/list/?series=11534",
            "date": "2017-11-02T15:46:01",
            "name": "[ipsec] xfrm: do unconditional template resolution before pcpu cache check",
            "version": 1,
            "mbox": "http://patchwork.ozlabs.org/series/11534/mbox/"
        }
    ],
    "comments": "http://patchwork.ozlabs.org/api/patches/833407/comments/",
    "check": "pending",
    "checks": "http://patchwork.ozlabs.org/api/patches/833407/checks/",
    "tags": {},
    "related": [],
    "headers": {
        "Return-Path": "<netdev-owner@vger.kernel.org>",
        "X-Original-To": "patchwork-incoming@ozlabs.org",
        "Delivered-To": "patchwork-incoming@ozlabs.org",
        "Authentication-Results": "ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=<UNKNOWN>)",
        "Received": [
            "from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3ySTvK5XkDz9s7h\n\tfor <patchwork-incoming@ozlabs.org>;\n\tFri,  3 Nov 2017 02:45:49 +1100 (AEDT)",
            "(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S933816AbdKBPpr (ORCPT <rfc822;patchwork-incoming@ozlabs.org>);\n\tThu, 2 Nov 2017 11:45:47 -0400",
            "from Chamillionaire.breakpoint.cc ([146.0.238.67]:59352 \"EHLO\n\tChamillionaire.breakpoint.cc\" rhost-flags-OK-OK-OK-OK)\n\tby vger.kernel.org with ESMTP id S933418AbdKBPpq (ORCPT\n\t<rfc822;netdev@vger.kernel.org>); Thu, 2 Nov 2017 11:45:46 -0400",
            "from fw by Chamillionaire.breakpoint.cc with local (Exim 4.84_2)\n\t(envelope-from <fw@breakpoint.cc>)\n\tid 1eAHgB-0007kL-Mc; Thu, 02 Nov 2017 16:45:16 +0100"
        ],
        "From": "Florian Westphal <fw@strlen.de>",
        "To": "<netdev@vger.kernel.org>",
        "Cc": "sds@tycho.nsa.gov, steffen.klassert@secunet.com,\n\tFlorian Westphal <fw@strlen.de>, Paul Moore <paul@paul-moore.com>",
        "Subject": "[PATCH ipsec] xfrm: do unconditional template resolution before\n\tpcpu cache check",
        "Date": "Thu,  2 Nov 2017 16:46:01 +0100",
        "Message-Id": "<20171102154601.25590-1-fw@strlen.de>",
        "X-Mailer": "git-send-email 2.13.6",
        "Sender": "netdev-owner@vger.kernel.org",
        "Precedence": "bulk",
        "List-ID": "<netdev.vger.kernel.org>",
        "X-Mailing-List": "netdev@vger.kernel.org"
    },
    "content": "Stephen Smalley says:\n Since 4.14-rc1, the selinux-testsuite has been encountering sporadic\n failures during testing of labeled IPSEC. git bisect pointed to\n commit ec30d (\"xfrm: add xdst pcpu cache\").\n The xdst pcpu cache is only checking that the policies are the same,\n but does not validate that the policy, state, and flow match with respect\n to security context labeling.\n As a result, the wrong SA could be used and the receiver could end up\n performing permission checking and providing SO_PEERSEC or SCM_SECURITY\n values for the wrong security context.\n\nThis fix makes it so that we always do the template resolution, and\nthen checks that the found states match those in the pcpu bundle.\n\nThis has the disadvantage of doing a bit more work (lookup in state hash\ntable) if we can reuse the xdst entry (we only avoid xdst alloc/free)\nbut we don't add a lot of extra work in case we can't reuse.\n\nxfrm_pol_dead() check is removed, reasoning is that\nxfrm_tmpl_resolve does all needed checks.\n\nCc: Paul Moore <paul@paul-moore.com>\nFixes: ec30d78c14a813db39a647b6a348b428 (\"xfrm: add xdst pcpu cache\")\nReported-by: Stephen Smalley <sds@tycho.nsa.gov>\nTested-by: Stephen Smalley <sds@tycho.nsa.gov>\nSigned-off-by: Florian Westphal <fw@strlen.de>\n---\n net/xfrm/xfrm_policy.c | 42 ++++++++++++++++++++++++------------------\n 1 file changed, 24 insertions(+), 18 deletions(-)",
    "diff": "diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c\nindex 8cafb3c0a4ac..a2e531bf4f97 100644\n--- a/net/xfrm/xfrm_policy.c\n+++ b/net/xfrm/xfrm_policy.c\n@@ -1787,19 +1787,23 @@ void xfrm_policy_cache_flush(void)\n \tput_online_cpus();\n }\n \n-static bool xfrm_pol_dead(struct xfrm_dst *xdst)\n+static bool xfrm_xdst_can_reuse(struct xfrm_dst *xdst,\n+\t\t\t\tstruct xfrm_state * const xfrm[],\n+\t\t\t\tint num)\n {\n-\tunsigned int num_pols = xdst->num_pols;\n-\tunsigned int pol_dead = 0, i;\n+\tconst struct dst_entry *dst = &xdst->u.dst;\n+\tint i;\n \n-\tfor (i = 0; i < num_pols; i++)\n-\t\tpol_dead |= xdst->pols[i]->walk.dead;\n+\tif (xdst->num_xfrms != num)\n+\t\treturn false;\n \n-\t/* Mark DST_OBSOLETE_DEAD to fail the next xfrm_dst_check() */\n-\tif (pol_dead)\n-\t\txdst->u.dst.obsolete = DST_OBSOLETE_DEAD;\n+\tfor (i = 0; i < num; i++) {\n+\t\tif (!dst || dst->xfrm != xfrm[i])\n+\t\t\treturn false;\n+\t\tdst = dst->child;\n+\t}\n \n-\treturn pol_dead;\n+\treturn xfrm_bundle_ok(xdst);\n }\n \n static struct xfrm_dst *\n@@ -1813,26 +1817,28 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,\n \tstruct dst_entry *dst;\n \tint err;\n \n+\t/* Try to instantiate a bundle */\n+\terr = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family);\n+\tif (err <= 0) {\n+\t\tif (err != 0 && err != -EAGAIN)\n+\t\t\tXFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);\n+\t\treturn ERR_PTR(err);\n+\t}\n+\n \txdst = this_cpu_read(xfrm_last_dst);\n \tif (xdst &&\n \t    xdst->u.dst.dev == dst_orig->dev &&\n \t    xdst->num_pols == num_pols &&\n-\t    !xfrm_pol_dead(xdst) &&\n \t    memcmp(xdst->pols, pols,\n \t\t   sizeof(struct xfrm_policy *) * num_pols) == 0 &&\n-\t    xfrm_bundle_ok(xdst)) {\n+\t    xfrm_xdst_can_reuse(xdst, xfrm, err)) {\n \t\tdst_hold(&xdst->u.dst);\n+\t\twhile (err > 0)\n+\t\t\txfrm_state_put(xfrm[--err]);\n \t\treturn xdst;\n \t}\n \n \told = xdst;\n-\t/* Try to instantiate a bundle */\n-\terr = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family);\n-\tif (err <= 0) {\n-\t\tif (err != 0 && err != -EAGAIN)\n-\t\t\tXFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);\n-\t\treturn ERR_PTR(err);\n-\t}\n \n \tdst = xfrm_bundle_create(pols[0], xfrm, err, fl, dst_orig);\n \tif (IS_ERR(dst)) {\n",
    "prefixes": [
        "ipsec"
    ]
}