[IPSEC]: Temporarily remove locks around copying of non-atomic fields

[safe/jmp/linux-2.6] / net / key / af_key.c

diff --git a/net/key/af_key.c b/net/key/af_key.c
index 5b802bb..878039b 100644 (file)
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -136,11 +136,14 @@ static struct proto key_proto = {
        .obj_size = sizeof(struct pfkey_sock),
 };
 
-static int pfkey_create(struct socket *sock, int protocol)
+static int pfkey_create(struct net *net, struct socket *sock, int protocol)
 {
        struct sock *sk;
        int err;
 
+       if (net != &init_net)
+               return -EAFNOSUPPORT;
+
        if (!capable(CAP_NET_ADMIN))
                return -EPERM;
        if (sock->type != SOCK_RAW)
@@ -149,7 +152,7 @@ static int pfkey_create(struct socket *sock, int protocol)
                return -EPROTONOSUPPORT;
 
        err = -ENOMEM;
-       sk = sk_alloc(PF_KEY, GFP_KERNEL, &key_proto, 1);
+       sk = sk_alloc(net, PF_KEY, GFP_KERNEL, &key_proto);
        if (sk == NULL)
                goto out;
 
@@ -392,9 +395,9 @@ static inline int pfkey_sec_ctx_len(struct sadb_x_sec_ctx *sec_ctx)
 static inline int verify_sec_ctx_len(void *p)
 {
        struct sadb_x_sec_ctx *sec_ctx = (struct sadb_x_sec_ctx *)p;
-       int len;
+       int len = sec_ctx->sadb_x_ctx_len;
 
-       if (sec_ctx->sadb_x_ctx_len > PAGE_SIZE)
+       if (len > PAGE_SIZE)
                return -EINVAL;
 
        len = pfkey_sec_ctx_len(sec_ctx);
@@ -652,7 +655,8 @@ static inline int pfkey_mode_to_xfrm(int mode)
        }
 }
 
-static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys, int hsc)
+static struct sk_buff *__pfkey_xfrm_state2msg(struct xfrm_state *x,
+                                             int add_keys, int hsc)
 {
        struct sk_buff *skb;
        struct sadb_msg *hdr;
@@ -1006,6 +1010,22 @@ static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys,
        return skb;
 }
 
+
+static inline struct sk_buff *pfkey_xfrm_state2msg(struct xfrm_state *x)
+{
+       struct sk_buff *skb;
+
+       skb = __pfkey_xfrm_state2msg(x, 1, 3);
+
+       return skb;
+}
+
+static inline struct sk_buff *pfkey_xfrm_state2msg_expire(struct xfrm_state *x,
+                                                         int hsc)
+{
+       return __pfkey_xfrm_state2msg(x, 0, hsc);
+}
+
 static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
                                                void **ext_hdrs)
 {
@@ -1250,8 +1270,11 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
        struct sadb_x_sa2 *sa2;
        struct sadb_address *saddr, *daddr;
        struct sadb_msg *out_hdr;
+       struct sadb_spirange *range;
        struct xfrm_state *x = NULL;
        int mode;
+       int err;
+       u32 min_spi, max_spi;
        u32 reqid;
        u8 proto;
        unsigned short family;
@@ -1306,25 +1329,17 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
        if (x == NULL)
                return -ENOENT;
 
-       resp_skb = ERR_PTR(-ENOENT);
+       min_spi = 0x100;
+       max_spi = 0x0fffffff;
 
-       spin_lock_bh(&x->lock);
-       if (x->km.state != XFRM_STATE_DEAD) {
-               struct sadb_spirange *range = ext_hdrs[SADB_EXT_SPIRANGE-1];
-               u32 min_spi, max_spi;
-
-               if (range != NULL) {
-                       min_spi = range->sadb_spirange_min;
-                       max_spi = range->sadb_spirange_max;
-               } else {
-                       min_spi = 0x100;
-                       max_spi = 0x0fffffff;
-               }
-               xfrm_alloc_spi(x, htonl(min_spi), htonl(max_spi));
-               if (x->id.spi)
-                       resp_skb = pfkey_xfrm_state2msg(x, 0, 3);
+       range = ext_hdrs[SADB_EXT_SPIRANGE-1];
+       if (range) {
+               min_spi = range->sadb_spirange_min;
+               max_spi = range->sadb_spirange_max;
        }
-       spin_unlock_bh(&x->lock);
+
+       err = xfrm_alloc_spi(x, min_spi, max_spi);
+       resp_skb = err ? ERR_PTR(err) : pfkey_xfrm_state2msg(x);
 
        if (IS_ERR(resp_skb)) {
                xfrm_state_put(x);
@@ -1414,12 +1429,8 @@ static int key_notify_sa(struct xfrm_state *x, struct km_event *c)
 {
        struct sk_buff *skb;
        struct sadb_msg *hdr;
-       int hsc = 3;
 
-       if (c->event == XFRM_MSG_DELSA)
-               hsc = 0;
-
-       skb = pfkey_xfrm_state2msg(x, 0, hsc);
+       skb = pfkey_xfrm_state2msg(x);
 
        if (IS_ERR(skb))
                return PTR_ERR(skb);
@@ -1531,7 +1542,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
        if (x == NULL)
                return -ESRCH;
 
-       out_skb = pfkey_xfrm_state2msg(x, 1, 3);
+       out_skb = pfkey_xfrm_state2msg(x);
        proto = x->id.proto;
        xfrm_state_put(x);
        if (IS_ERR(out_skb))
@@ -1539,7 +1550,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
 
        out_hdr = (struct sadb_msg *) out_skb->data;
        out_hdr->sadb_msg_version = hdr->sadb_msg_version;
-       out_hdr->sadb_msg_type = SADB_DUMP;
+       out_hdr->sadb_msg_type = SADB_GET;
        out_hdr->sadb_msg_satype = pfkey_proto2satype(proto);
        out_hdr->sadb_msg_errno = 0;
        out_hdr->sadb_msg_reserved = 0;
@@ -1711,7 +1722,7 @@ static int dump_sa(struct xfrm_state *x, int count, void *ptr)
        struct sk_buff *out_skb;
        struct sadb_msg *out_hdr;
 
-       out_skb = pfkey_xfrm_state2msg(x, 1, 3);
+       out_skb = pfkey_xfrm_state2msg(x);
        if (IS_ERR(out_skb))
                return PTR_ERR(out_skb);
 
@@ -2912,7 +2923,7 @@ static int key_notify_sa_expire(struct xfrm_state *x, struct km_event *c)
        else
                hsc = 1;
 
-       out_skb = pfkey_xfrm_state2msg(x, 0, hsc);
+       out_skb = pfkey_xfrm_state2msg_expire(x, hsc);
        if (IS_ERR(out_skb))
                return PTR_ERR(out_skb);