xfrm_compat.c

  1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 * XFRM compat layer
  4 * Author: Dmitry Safonov <dima@arista.com>
  5 * Based on code and translator idea by: Florian Westphal <fw@strlen.de>
  6 */
  7#include <linux/compat.h>
  8#include <linux/nospec.h>
  9#include <linux/xfrm.h>
 10#include <net/xfrm.h>
 11
 12struct compat_xfrm_lifetime_cfg {
 13	compat_u64 soft_byte_limit, hard_byte_limit;
 14	compat_u64 soft_packet_limit, hard_packet_limit;
 15	compat_u64 soft_add_expires_seconds, hard_add_expires_seconds;
 16	compat_u64 soft_use_expires_seconds, hard_use_expires_seconds;
 17}; /* same size on 32bit, but only 4 byte alignment required */
 18
 19struct compat_xfrm_lifetime_cur {
 20	compat_u64 bytes, packets, add_time, use_time;
 21}; /* same size on 32bit, but only 4 byte alignment required */
 22
 23struct compat_xfrm_userpolicy_info {
 24	struct xfrm_selector sel;
 25	struct compat_xfrm_lifetime_cfg lft;
 26	struct compat_xfrm_lifetime_cur curlft;
 27	__u32 priority, index;
 28	u8 dir, action, flags, share;
 29	/* 4 bytes additional padding on 64bit */
 30};
 31
 32struct compat_xfrm_usersa_info {
 33	struct xfrm_selector sel;
 34	struct xfrm_id id;
 35	xfrm_address_t saddr;
 36	struct compat_xfrm_lifetime_cfg lft;
 37	struct compat_xfrm_lifetime_cur curlft;
 38	struct xfrm_stats stats;
 39	__u32 seq, reqid;
 40	u16 family;
 41	u8 mode, replay_window, flags;
 42	/* 4 bytes additional padding on 64bit */
 43};
 44
 45struct compat_xfrm_user_acquire {
 46	struct xfrm_id id;
 47	xfrm_address_t saddr;
 48	struct xfrm_selector sel;
 49	struct compat_xfrm_userpolicy_info policy;
 50	/* 4 bytes additional padding on 64bit */
 51	__u32 aalgos, ealgos, calgos, seq;
 52};
 53
 54struct compat_xfrm_userspi_info {
 55	struct compat_xfrm_usersa_info info;
 56	/* 4 bytes additional padding on 64bit */
 57	__u32 min, max;
 58};
 59
 60struct compat_xfrm_user_expire {
 61	struct compat_xfrm_usersa_info state;
 62	/* 8 bytes additional padding on 64bit */
 63	u8 hard;
 64};
 65
 66struct compat_xfrm_user_polexpire {
 67	struct compat_xfrm_userpolicy_info pol;
 68	/* 8 bytes additional padding on 64bit */
 69	u8 hard;
 70};
 71
 72#define XMSGSIZE(type) sizeof(struct type)
 73
 74static const int compat_msg_min[XFRM_NR_MSGTYPES] = {
 75	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_usersa_info),
 76	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
 77	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
 78	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userpolicy_info),
 79	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
 80	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
 81	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userspi_info),
 82	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_acquire),
 83	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_expire),
 84	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userpolicy_info),
 85	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_usersa_info),
 86	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_polexpire),
 87	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
 88	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
 89	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
 90	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
 91	[XFRM_MSG_REPORT      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
 92	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
 93	[XFRM_MSG_NEWSADINFO  - XFRM_MSG_BASE] = sizeof(u32),
 94	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = sizeof(u32),
 95	[XFRM_MSG_NEWSPDINFO  - XFRM_MSG_BASE] = sizeof(u32),
 96	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = sizeof(u32),
 97	[XFRM_MSG_MAPPING     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_mapping)
 98};
 99
100static const struct nla_policy compat_policy[XFRMA_MAX+1] = {
101	[XFRMA_UNSPEC]          = { .strict_start_type = XFRMA_SA_DIR },
102	[XFRMA_SA]		= { .len = XMSGSIZE(compat_xfrm_usersa_info)},
103	[XFRMA_POLICY]		= { .len = XMSGSIZE(compat_xfrm_userpolicy_info)},
104	[XFRMA_LASTUSED]	= { .type = NLA_U64},
105	[XFRMA_ALG_AUTH_TRUNC]	= { .len = sizeof(struct xfrm_algo_auth)},
106	[XFRMA_ALG_AEAD]	= { .len = sizeof(struct xfrm_algo_aead) },
107	[XFRMA_ALG_AUTH]	= { .len = sizeof(struct xfrm_algo) },
108	[XFRMA_ALG_CRYPT]	= { .len = sizeof(struct xfrm_algo) },
109	[XFRMA_ALG_COMP]	= { .len = sizeof(struct xfrm_algo) },
110	[XFRMA_ENCAP]		= { .len = sizeof(struct xfrm_encap_tmpl) },
111	[XFRMA_TMPL]		= { .len = sizeof(struct xfrm_user_tmpl) },
112	[XFRMA_SEC_CTX]		= { .len = sizeof(struct xfrm_user_sec_ctx) },
113	[XFRMA_LTIME_VAL]	= { .len = sizeof(struct xfrm_lifetime_cur) },
114	[XFRMA_REPLAY_VAL]	= { .len = sizeof(struct xfrm_replay_state) },
115	[XFRMA_REPLAY_THRESH]	= { .type = NLA_U32 },
116	[XFRMA_ETIMER_THRESH]	= { .type = NLA_U32 },
117	[XFRMA_SRCADDR]		= { .len = sizeof(xfrm_address_t) },
118	[XFRMA_COADDR]		= { .len = sizeof(xfrm_address_t) },
119	[XFRMA_POLICY_TYPE]	= { .len = sizeof(struct xfrm_userpolicy_type)},
120	[XFRMA_MIGRATE]		= { .len = sizeof(struct xfrm_user_migrate) },
121	[XFRMA_KMADDRESS]	= { .len = sizeof(struct xfrm_user_kmaddress) },
122	[XFRMA_MARK]		= { .len = sizeof(struct xfrm_mark) },
123	[XFRMA_TFCPAD]		= { .type = NLA_U32 },
124	[XFRMA_REPLAY_ESN_VAL]	= { .len = sizeof(struct xfrm_replay_state_esn) },
125	[XFRMA_SA_EXTRA_FLAGS]	= { .type = NLA_U32 },
126	[XFRMA_PROTO]		= { .type = NLA_U8 },
127	[XFRMA_ADDRESS_FILTER]	= { .len = sizeof(struct xfrm_address_filter) },
128	[XFRMA_OFFLOAD_DEV]	= { .len = sizeof(struct xfrm_user_offload) },
129	[XFRMA_SET_MARK]	= { .type = NLA_U32 },
130	[XFRMA_SET_MARK_MASK]	= { .type = NLA_U32 },
131	[XFRMA_IF_ID]		= { .type = NLA_U32 },
132	[XFRMA_MTIMER_THRESH]	= { .type = NLA_U32 },
133	[XFRMA_SA_DIR]          = NLA_POLICY_RANGE(NLA_U8, XFRM_SA_DIR_IN, XFRM_SA_DIR_OUT),
134	[XFRMA_NAT_KEEPALIVE_INTERVAL]	= { .type = NLA_U32 },
135	[XFRMA_SA_PCPU]		= { .type = NLA_U32 },
136};
137
138static struct nlmsghdr *xfrm_nlmsg_put_compat(struct sk_buff *skb,
139			const struct nlmsghdr *nlh_src, u16 type)
140{
141	int payload = compat_msg_min[type];
142	int src_len = xfrm_msg_min[type];
143	struct nlmsghdr *nlh_dst;
144
145	/* Compat messages are shorter or equal to native (+padding) */
146	if (WARN_ON_ONCE(src_len < payload))
147		return ERR_PTR(-EMSGSIZE);
148
149	nlh_dst = nlmsg_put(skb, nlh_src->nlmsg_pid, nlh_src->nlmsg_seq,
150			    nlh_src->nlmsg_type, payload, nlh_src->nlmsg_flags);
151	if (!nlh_dst)
152		return ERR_PTR(-EMSGSIZE);
153
154	memset(nlmsg_data(nlh_dst), 0, payload);
155
156	switch (nlh_src->nlmsg_type) {
157	/* Compat message has the same layout as native */
158	case XFRM_MSG_DELSA:
159	case XFRM_MSG_DELPOLICY:
160	case XFRM_MSG_FLUSHSA:
161	case XFRM_MSG_FLUSHPOLICY:
162	case XFRM_MSG_NEWAE:
163	case XFRM_MSG_REPORT:
164	case XFRM_MSG_MIGRATE:
165	case XFRM_MSG_NEWSADINFO:
166	case XFRM_MSG_NEWSPDINFO:
167	case XFRM_MSG_MAPPING:
168		WARN_ON_ONCE(src_len != payload);
169		memcpy(nlmsg_data(nlh_dst), nlmsg_data(nlh_src), src_len);
170		break;
171	/* 4 byte alignment for trailing u64 on native, but not on compat */
172	case XFRM_MSG_NEWSA:
173	case XFRM_MSG_NEWPOLICY:
174	case XFRM_MSG_UPDSA:
175	case XFRM_MSG_UPDPOLICY:
176		WARN_ON_ONCE(src_len != payload + 4);
177		memcpy(nlmsg_data(nlh_dst), nlmsg_data(nlh_src), payload);
178		break;
179	case XFRM_MSG_EXPIRE: {
180		const struct xfrm_user_expire *src_ue  = nlmsg_data(nlh_src);
181		struct compat_xfrm_user_expire *dst_ue = nlmsg_data(nlh_dst);
182
183		/* compat_xfrm_user_expire has 4-byte smaller state */
184		memcpy(dst_ue, src_ue, sizeof(dst_ue->state));
185		dst_ue->hard = src_ue->hard;
186		break;
187	}
188	case XFRM_MSG_ACQUIRE: {
189		const struct xfrm_user_acquire *src_ua  = nlmsg_data(nlh_src);
190		struct compat_xfrm_user_acquire *dst_ua = nlmsg_data(nlh_dst);
191
192		memcpy(dst_ua, src_ua, offsetof(struct compat_xfrm_user_acquire, aalgos));
193		dst_ua->aalgos = src_ua->aalgos;
194		dst_ua->ealgos = src_ua->ealgos;
195		dst_ua->calgos = src_ua->calgos;
196		dst_ua->seq    = src_ua->seq;
197		break;
198	}
199	case XFRM_MSG_POLEXPIRE: {
200		const struct xfrm_user_polexpire *src_upe  = nlmsg_data(nlh_src);
201		struct compat_xfrm_user_polexpire *dst_upe = nlmsg_data(nlh_dst);
202
203		/* compat_xfrm_user_polexpire has 4-byte smaller state */
204		memcpy(dst_upe, src_upe, sizeof(dst_upe->pol));
205		dst_upe->hard = src_upe->hard;
206		break;
207	}
208	case XFRM_MSG_ALLOCSPI: {
209		const struct xfrm_userspi_info *src_usi = nlmsg_data(nlh_src);
210		struct compat_xfrm_userspi_info *dst_usi = nlmsg_data(nlh_dst);
211
212		/* compat_xfrm_user_polexpire has 4-byte smaller state */
213		memcpy(dst_usi, src_usi, sizeof(src_usi->info));
214		dst_usi->min = src_usi->min;
215		dst_usi->max = src_usi->max;
216		break;
217	}
218	/* Not being sent by kernel */
219	case XFRM_MSG_GETSA:
220	case XFRM_MSG_GETPOLICY:
221	case XFRM_MSG_GETAE:
222	case XFRM_MSG_GETSADINFO:
223	case XFRM_MSG_GETSPDINFO:
224	default:
225		pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);
226		return ERR_PTR(-EOPNOTSUPP);
227	}
228
229	return nlh_dst;
230}
231
232static int xfrm_nla_cpy(struct sk_buff *dst, const struct nlattr *src, int len)
233{
234	return nla_put(dst, src->nla_type, len, nla_data(src));
235}
236
237static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src)
238{
239	switch (src->nla_type) {
240	case XFRMA_PAD:
241		/* Ignore */
242		return 0;
243	case XFRMA_UNSPEC:
244	case XFRMA_ALG_AUTH:
245	case XFRMA_ALG_CRYPT:
246	case XFRMA_ALG_COMP:
247	case XFRMA_ENCAP:
248	case XFRMA_TMPL:
249		return xfrm_nla_cpy(dst, src, nla_len(src));
250	case XFRMA_SA:
251		return xfrm_nla_cpy(dst, src, XMSGSIZE(compat_xfrm_usersa_info));
252	case XFRMA_POLICY:
253		return xfrm_nla_cpy(dst, src, XMSGSIZE(compat_xfrm_userpolicy_info));
254	case XFRMA_SEC_CTX:
255		return xfrm_nla_cpy(dst, src, nla_len(src));
256	case XFRMA_LTIME_VAL:
257		return nla_put_64bit(dst, src->nla_type, nla_len(src),
258			nla_data(src), XFRMA_PAD);
259	case XFRMA_REPLAY_VAL:
260	case XFRMA_REPLAY_THRESH:
261	case XFRMA_ETIMER_THRESH:
262	case XFRMA_SRCADDR:
263	case XFRMA_COADDR:
264		return xfrm_nla_cpy(dst, src, nla_len(src));
265	case XFRMA_LASTUSED:
266		return nla_put_64bit(dst, src->nla_type, nla_len(src),
267			nla_data(src), XFRMA_PAD);
268	case XFRMA_POLICY_TYPE:
269	case XFRMA_MIGRATE:
270	case XFRMA_ALG_AEAD:
271	case XFRMA_KMADDRESS:
272	case XFRMA_ALG_AUTH_TRUNC:
273	case XFRMA_MARK:
274	case XFRMA_TFCPAD:
275	case XFRMA_REPLAY_ESN_VAL:
276	case XFRMA_SA_EXTRA_FLAGS:
277	case XFRMA_PROTO:
278	case XFRMA_ADDRESS_FILTER:
279	case XFRMA_OFFLOAD_DEV:
280	case XFRMA_SET_MARK:
281	case XFRMA_SET_MARK_MASK:
282	case XFRMA_IF_ID:
283	case XFRMA_MTIMER_THRESH:
284	case XFRMA_SA_DIR:
285	case XFRMA_NAT_KEEPALIVE_INTERVAL:
286	case XFRMA_SA_PCPU:
287	case XFRMA_IPTFS_DROP_TIME:
288	case XFRMA_IPTFS_REORDER_WINDOW:
289	case XFRMA_IPTFS_DONT_FRAG:
290	case XFRMA_IPTFS_INIT_DELAY:
291	case XFRMA_IPTFS_MAX_QSIZE:
292	case XFRMA_IPTFS_PKT_SIZE:
293		return xfrm_nla_cpy(dst, src, nla_len(src));
294	default:
295		BUILD_BUG_ON(XFRMA_MAX != XFRMA_IPTFS_PKT_SIZE);
296		pr_warn_once("unsupported nla_type %d\n", src->nla_type);
297		return -EOPNOTSUPP;
298	}
299}
300
301/* Take kernel-built (64bit layout) and create 32bit layout for userspace */
302static int xfrm_xlate64(struct sk_buff *dst, const struct nlmsghdr *nlh_src)
303{
304	u16 type = nlh_src->nlmsg_type - XFRM_MSG_BASE;
305	const struct nlattr *nla, *attrs;
306	struct nlmsghdr *nlh_dst;
307	int len, remaining;
308
309	nlh_dst = xfrm_nlmsg_put_compat(dst, nlh_src, type);
310	if (IS_ERR(nlh_dst))
311		return PTR_ERR(nlh_dst);
312
313	attrs = nlmsg_attrdata(nlh_src, xfrm_msg_min[type]);
314	len = nlmsg_attrlen(nlh_src, xfrm_msg_min[type]);
315
316	nla_for_each_attr(nla, attrs, len, remaining) {
317		int err;
318
319		switch (nlh_src->nlmsg_type) {
320		case XFRM_MSG_NEWSPDINFO:
321			err = xfrm_nla_cpy(dst, nla, nla_len(nla));
322			break;
323		default:
324			err = xfrm_xlate64_attr(dst, nla);
325			break;
326		}
327		if (err)
328			return err;
329	}
330
331	nlmsg_end(dst, nlh_dst);
332
333	return 0;
334}
335
336static int xfrm_alloc_compat(struct sk_buff *skb, const struct nlmsghdr *nlh_src)
337{
338	u16 type = nlh_src->nlmsg_type - XFRM_MSG_BASE;
339	struct sk_buff *new = NULL;
340	int err;
341
342	if (type >= ARRAY_SIZE(xfrm_msg_min)) {
343		pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);
344		return -EOPNOTSUPP;
345	}
346
347	if (skb_shinfo(skb)->frag_list == NULL) {
348		new = alloc_skb(skb->len + skb_tailroom(skb), GFP_ATOMIC);
349		if (!new)
350			return -ENOMEM;
351		skb_shinfo(skb)->frag_list = new;
352	}
353
354	err = xfrm_xlate64(skb_shinfo(skb)->frag_list, nlh_src);
355	if (err) {
356		if (new) {
357			kfree_skb(new);
358			skb_shinfo(skb)->frag_list = NULL;
359		}
360		return err;
361	}
362
363	return 0;
364}
365
366/* Calculates len of translated 64-bit message. */
367static size_t xfrm_user_rcv_calculate_len64(const struct nlmsghdr *src,
368					    struct nlattr *attrs[XFRMA_MAX + 1],
369					    int maxtype)
370{
371	size_t len = nlmsg_len(src);
372
373	switch (src->nlmsg_type) {
374	case XFRM_MSG_NEWSA:
375	case XFRM_MSG_NEWPOLICY:
376	case XFRM_MSG_ALLOCSPI:
377	case XFRM_MSG_ACQUIRE:
378	case XFRM_MSG_UPDPOLICY:
379	case XFRM_MSG_UPDSA:
380		len += 4;
381		break;
382	case XFRM_MSG_EXPIRE:
383	case XFRM_MSG_POLEXPIRE:
384		len += 8;
385		break;
386	case XFRM_MSG_NEWSPDINFO:
387		/* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */
388		return len;
389	default:
390		break;
391	}
392
393	/* Unexpected for anything, but XFRM_MSG_NEWSPDINFO, please
394	 * correct both 64=>32-bit and 32=>64-bit translators to copy
395	 * new attributes.
396	 */
397	if (WARN_ON_ONCE(maxtype))
398		return len;
399
400	if (attrs[XFRMA_SA])
401		len += 4;
402	if (attrs[XFRMA_POLICY])
403		len += 4;
404
405	/* XXX: some attrs may need to be realigned
406	 * if !CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
407	 */
408
409	return len;
410}
411
412static int xfrm_attr_cpy32(void *dst, size_t *pos, const struct nlattr *src,
413			   size_t size, int copy_len, int payload)
414{
415	struct nlmsghdr *nlmsg = dst;
416	struct nlattr *nla;
417
418	/* xfrm_user_rcv_msg_compat() relies on fact that 32-bit messages
419	 * have the same len or shorted than 64-bit ones.
420	 * 32-bit translation that is bigger than 64-bit original is unexpected.
421	 */
422	if (WARN_ON_ONCE(copy_len > payload))
423		copy_len = payload;
424
425	if (size - *pos < nla_attr_size(payload))
426		return -ENOBUFS;
427
428	nla = dst + *pos;
429
430	memcpy(nla, src, nla_attr_size(copy_len));
431	nla->nla_len = nla_attr_size(payload);
432	*pos += nla_attr_size(copy_len);
433	nlmsg->nlmsg_len += nla->nla_len;
434
435	memset(dst + *pos, 0, payload - copy_len);
436	*pos += payload - copy_len;
437
438	return 0;
439}
440
441static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla,
442			     size_t *pos, size_t size,
443			     struct netlink_ext_ack *extack)
444{
445	int type = nla_type(nla);
446	u16 pol_len32, pol_len64;
447	int err;
448
449	if (type > XFRMA_MAX) {
450		BUILD_BUG_ON(XFRMA_MAX != XFRMA_IPTFS_PKT_SIZE);
451		NL_SET_ERR_MSG(extack, "Bad attribute");
452		return -EOPNOTSUPP;
453	}
454	type = array_index_nospec(type, XFRMA_MAX + 1);
455	if (nla_len(nla) < compat_policy[type].len) {
456		NL_SET_ERR_MSG(extack, "Attribute bad length");
457		return -EOPNOTSUPP;
458	}
459
460	pol_len32 = compat_policy[type].len;
461	pol_len64 = xfrma_policy[type].len;
462
463	/* XFRMA_SA and XFRMA_POLICY - need to know how-to translate */
464	if (pol_len32 != pol_len64) {
465		if (nla_len(nla) != compat_policy[type].len) {
466			NL_SET_ERR_MSG(extack, "Attribute bad length");
467			return -EOPNOTSUPP;
468		}
469		err = xfrm_attr_cpy32(dst, pos, nla, size, pol_len32, pol_len64);
470		if (err)
471			return err;
472	}
473
474	return xfrm_attr_cpy32(dst, pos, nla, size, nla_len(nla), nla_len(nla));
475}
476
477static int xfrm_xlate32(struct nlmsghdr *dst, const struct nlmsghdr *src,
478			struct nlattr *attrs[XFRMA_MAX+1],
479			size_t size, u8 type, int maxtype,
480			struct netlink_ext_ack *extack)
481{
482	size_t pos;
483	int i;
484
485	memcpy(dst, src, NLMSG_HDRLEN);
486	dst->nlmsg_len = NLMSG_HDRLEN + xfrm_msg_min[type];
487	memset(nlmsg_data(dst), 0, xfrm_msg_min[type]);
488
489	switch (src->nlmsg_type) {
490	/* Compat message has the same layout as native */
491	case XFRM_MSG_DELSA:
492	case XFRM_MSG_GETSA:
493	case XFRM_MSG_DELPOLICY:
494	case XFRM_MSG_GETPOLICY:
495	case XFRM_MSG_FLUSHSA:
496	case XFRM_MSG_FLUSHPOLICY:
497	case XFRM_MSG_NEWAE:
498	case XFRM_MSG_GETAE:
499	case XFRM_MSG_REPORT:
500	case XFRM_MSG_MIGRATE:
501	case XFRM_MSG_NEWSADINFO:
502	case XFRM_MSG_GETSADINFO:
503	case XFRM_MSG_NEWSPDINFO:
504	case XFRM_MSG_GETSPDINFO:
505	case XFRM_MSG_MAPPING:
506		memcpy(nlmsg_data(dst), nlmsg_data(src), compat_msg_min[type]);
507		break;
508	/* 4 byte alignment for trailing u64 on native, but not on compat */
509	case XFRM_MSG_NEWSA:
510	case XFRM_MSG_NEWPOLICY:
511	case XFRM_MSG_UPDSA:
512	case XFRM_MSG_UPDPOLICY:
513		memcpy(nlmsg_data(dst), nlmsg_data(src), compat_msg_min[type]);
514		break;
515	case XFRM_MSG_EXPIRE: {
516		const struct compat_xfrm_user_expire *src_ue = nlmsg_data(src);
517		struct xfrm_user_expire *dst_ue = nlmsg_data(dst);
518
519		/* compat_xfrm_user_expire has 4-byte smaller state */
520		memcpy(dst_ue, src_ue, sizeof(src_ue->state));
521		dst_ue->hard = src_ue->hard;
522		break;
523	}
524	case XFRM_MSG_ACQUIRE: {
525		const struct compat_xfrm_user_acquire *src_ua = nlmsg_data(src);
526		struct xfrm_user_acquire *dst_ua = nlmsg_data(dst);
527
528		memcpy(dst_ua, src_ua, offsetof(struct compat_xfrm_user_acquire, aalgos));
529		dst_ua->aalgos = src_ua->aalgos;
530		dst_ua->ealgos = src_ua->ealgos;
531		dst_ua->calgos = src_ua->calgos;
532		dst_ua->seq    = src_ua->seq;
533		break;
534	}
535	case XFRM_MSG_POLEXPIRE: {
536		const struct compat_xfrm_user_polexpire *src_upe = nlmsg_data(src);
537		struct xfrm_user_polexpire *dst_upe = nlmsg_data(dst);
538
539		/* compat_xfrm_user_polexpire has 4-byte smaller state */
540		memcpy(dst_upe, src_upe, sizeof(src_upe->pol));
541		dst_upe->hard = src_upe->hard;
542		break;
543	}
544	case XFRM_MSG_ALLOCSPI: {
545		const struct compat_xfrm_userspi_info *src_usi = nlmsg_data(src);
546		struct xfrm_userspi_info *dst_usi = nlmsg_data(dst);
547
548		/* compat_xfrm_user_polexpire has 4-byte smaller state */
549		memcpy(dst_usi, src_usi, sizeof(src_usi->info));
550		dst_usi->min = src_usi->min;
551		dst_usi->max = src_usi->max;
552		break;
553	}
554	default:
555		NL_SET_ERR_MSG(extack, "Unsupported message type");
556		return -EOPNOTSUPP;
557	}
558	pos = dst->nlmsg_len;
559
560	if (maxtype) {
561		/* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */
562		WARN_ON_ONCE(src->nlmsg_type != XFRM_MSG_NEWSPDINFO);
563
564		for (i = 1; i <= maxtype; i++) {
565			int err;
566
567			if (!attrs[i])
568				continue;
569
570			/* just copy - no need for translation */
571			err = xfrm_attr_cpy32(dst, &pos, attrs[i], size,
572					nla_len(attrs[i]), nla_len(attrs[i]));
573			if (err)
574				return err;
575		}
576		return 0;
577	}
578
579	for (i = 1; i < XFRMA_MAX + 1; i++) {
580		int err;
581
582		if (i == XFRMA_PAD)
583			continue;
584
585		if (!attrs[i])
586			continue;
587
588		err = xfrm_xlate32_attr(dst, attrs[i], &pos, size, extack);
589		if (err)
590			return err;
591	}
592
593	return 0;
594}
595
596static struct nlmsghdr *xfrm_user_rcv_msg_compat(const struct nlmsghdr *h32,
597			int maxtype, const struct nla_policy *policy,
598			struct netlink_ext_ack *extack)
599{
600	/* netlink_rcv_skb() checks if a message has full (struct nlmsghdr) */
601	u16 type = h32->nlmsg_type - XFRM_MSG_BASE;
602	struct nlattr *attrs[XFRMA_MAX+1];
603	struct nlmsghdr *h64;
604	size_t len;
605	int err;
606
607	BUILD_BUG_ON(ARRAY_SIZE(xfrm_msg_min) != ARRAY_SIZE(compat_msg_min));
608
609	if (type >= ARRAY_SIZE(xfrm_msg_min))
610		return ERR_PTR(-EINVAL);
611
612	/* Don't call parse: the message might have only nlmsg header */
613	if ((h32->nlmsg_type == XFRM_MSG_GETSA ||
614	     h32->nlmsg_type == XFRM_MSG_GETPOLICY) &&
615	    (h32->nlmsg_flags & NLM_F_DUMP))
616		return NULL;
617
618	err = nlmsg_parse_deprecated(h32, compat_msg_min[type], attrs,
619			maxtype ? : XFRMA_MAX, policy ? : compat_policy, extack);
620	if (err < 0)
621		return ERR_PTR(err);
622
623	len = xfrm_user_rcv_calculate_len64(h32, attrs, maxtype);
624	/* The message doesn't need translation */
625	if (len == nlmsg_len(h32))
626		return NULL;
627
628	len += NLMSG_HDRLEN;
629	h64 = kvmalloc(len, GFP_KERNEL);
630	if (!h64)
631		return ERR_PTR(-ENOMEM);
632
633	err = xfrm_xlate32(h64, h32, attrs, len, type, maxtype, extack);
634	if (err < 0) {
635		kvfree(h64);
636		return ERR_PTR(err);
637	}
638
639	return h64;
640}
641
642static int xfrm_user_policy_compat(u8 **pdata32, int optlen)
643{
644	struct compat_xfrm_userpolicy_info *p = (void *)*pdata32;
645	u8 *src_templates, *dst_templates;
646	u8 *data64;
647
648	if (optlen < sizeof(*p))
649		return -EINVAL;
650
651	data64 = kmalloc_track_caller(optlen + 4, GFP_USER | __GFP_NOWARN);
652	if (!data64)
653		return -ENOMEM;
654
655	memcpy(data64, *pdata32, sizeof(*p));
656	memset(data64 + sizeof(*p), 0, 4);
657
658	src_templates = *pdata32 + sizeof(*p);
659	dst_templates = data64 + sizeof(*p) + 4;
660	memcpy(dst_templates, src_templates, optlen - sizeof(*p));
661
662	kfree(*pdata32);
663	*pdata32 = data64;
664	return 0;
665}
666
667static struct xfrm_translator xfrm_translator = {
668	.owner				= THIS_MODULE,
669	.alloc_compat			= xfrm_alloc_compat,
670	.rcv_msg_compat			= xfrm_user_rcv_msg_compat,
671	.xlate_user_policy_sockptr	= xfrm_user_policy_compat,
672};
673
674static int __init xfrm_compat_init(void)
675{
676	return xfrm_register_translator(&xfrm_translator);
677}
678
679static void __exit xfrm_compat_exit(void)
680{
681	xfrm_unregister_translator(&xfrm_translator);
682}
683
684module_init(xfrm_compat_init);
685module_exit(xfrm_compat_exit);
686MODULE_LICENSE("GPL");
687MODULE_AUTHOR("Dmitry Safonov");
688MODULE_DESCRIPTION("XFRM 32-bit compatibility layer");