Merge branch 'master' into for-next

Fast-forwarded to current state of Linus' tree as there are patches to be
applied for files that didn't exist on the old branch.

5 files changed, 69 insertions, 9 deletions

diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 872065ca7f8c..a026b0ef2443 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -173,7 +173,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                         goto drop_unlock;
                 }
 
-                if (x->props.replay_window && x->repl->check(x, skb, seq)) {
+                if (x->repl->check(x, skb, seq)) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
                         goto drop_unlock;
                 }
@@ -190,6 +190,8 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                 XFRM_SKB_CB(skb)->seq.input.low = seq;
                 XFRM_SKB_CB(skb)->seq.input.hi = seq_hi;
 
+                skb_dst_force(skb);
+
                 nexthdr = x->type->input(x, skb);
 
                 if (nexthdr == -EINPROGRESS)
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 1aba03f449cc..47bacd8c0250 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -78,6 +78,8 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
 
                 spin_unlock_bh(&x->lock);
 
+                skb_dst_force(skb);
+
                 err = x->type->output(x, skb);
                 if (err == -EINPROGRESS)
                         goto out_exit;
@@ -94,7 +96,7 @@ resume:
                         err = -EHOSTUNREACH;
                         goto error_nolock;
                 }
-                skb_dst_set(skb, dst_clone(dst));
+                skb_dst_set(skb, dst);
                 x = dst->xfrm;
         } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL));
 
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 2f5be5b15740..f218385950ca 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -118,6 +118,9 @@ static int xfrm_replay_check(struct xfrm_state *x,
         u32 diff;
         u32 seq = ntohl(net_seq);
 
+        if (!x->props.replay_window)
+                return 0;
+
         if (unlikely(seq == 0))
                 goto err;
 
@@ -193,9 +196,14 @@ static int xfrm_replay_check_bmp(struct xfrm_state *x,
 {
         unsigned int bitnr, nr;
         struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
+        u32 pos;
         u32 seq = ntohl(net_seq);
         u32 diff =  replay_esn->seq - seq;
-        u32 pos = (replay_esn->seq - 1) % replay_esn->replay_window;
+
+        if (!replay_esn->replay_window)
+                return 0;
+
+        pos = (replay_esn->seq - 1) % replay_esn->replay_window;
 
         if (unlikely(seq == 0))
                 goto err;
@@ -373,12 +381,17 @@ static int xfrm_replay_check_esn(struct xfrm_state *x,
         unsigned int bitnr, nr;
         u32 diff;
         struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
+        u32 pos;
         u32 seq = ntohl(net_seq);
-        u32 pos = (replay_esn->seq - 1) % replay_esn->replay_window;
         u32 wsize = replay_esn->replay_window;
         u32 top = replay_esn->seq;
         u32 bottom = top - wsize + 1;
 
+        if (!wsize)
+                return 0;
+
+        pos = (replay_esn->seq - 1) % replay_esn->replay_window;
+
         if (unlikely(seq == 0 && replay_esn->seq_hi == 0 &&
                      (replay_esn->seq < replay_esn->replay_window - 1)))
                 goto err;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index d575f0534868..dd78536d40de 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1181,6 +1181,12 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
                         goto error;
         }
 
+        if (orig->replay_esn) {
+                err = xfrm_replay_clone(x, orig);
+                if (err)
+                        goto error;
+        }
+
         memcpy(&x->mark, &orig->mark, sizeof(x->mark));
 
         err = xfrm_init_state(x);
@@ -1907,7 +1913,7 @@ int xfrm_state_mtu(struct xfrm_state *x, int mtu)
         return res;
 }
 
-int xfrm_init_state(struct xfrm_state *x)
+int __xfrm_init_state(struct xfrm_state *x, bool init_replay)
 {
         struct xfrm_state_afinfo *afinfo;
         struct xfrm_mode *inner_mode;
@@ -1980,12 +1986,25 @@ int xfrm_init_state(struct xfrm_state *x)
         if (x->outer_mode == NULL)
                 goto error;
 
+        if (init_replay) {
+                err = xfrm_init_replay(x);
+                if (err)
+                        goto error;
+        }
+
         x->km.state = XFRM_STATE_VALID;
 
 error:
         return err;
 }
 
+EXPORT_SYMBOL(__xfrm_init_state);
+
+int xfrm_init_state(struct xfrm_state *x)
+{
+        return __xfrm_init_state(x, true);
+}
+
 EXPORT_SYMBOL(xfrm_init_state);
 
 int __net_init xfrm_state_init(struct net *net)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 706385ae3e4b..5d1d60d3ca83 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -127,6 +127,9 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
         if (!rt)
                 return 0;
 
+        if (p->id.proto != IPPROTO_ESP)
+                return -EINVAL;
+
         if (p->replay_window != 0)
                 return -EINVAL;
 
@@ -360,6 +363,23 @@ static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props,
         return 0;
 }
 
+static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn,
+                                         struct nlattr *rp)
+{
+        struct xfrm_replay_state_esn *up;
+
+        if (!replay_esn || !rp)
+                return 0;
+
+        up = nla_data(rp);
+
+        if (xfrm_replay_state_esn_len(replay_esn) !=
+                        xfrm_replay_state_esn_len(up))
+                return -EINVAL;
+
+        return 0;
+}
+
 static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn,
                                        struct xfrm_replay_state_esn **preplay_esn,
                                        struct nlattr *rta)
@@ -511,7 +531,7 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
 
         xfrm_mark_get(attrs, &x->mark);
 
-        err = xfrm_init_state(x);
+        err = __xfrm_init_state(x, false);
         if (err)
                 goto error;
 
@@ -874,7 +894,7 @@ static int build_spdinfo(struct sk_buff *skb, struct net *net,
         u32 *f;
 
         nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSPDINFO, sizeof(u32), 0);
-        if (nlh == NULL) /* shouldnt really happen ... */
+        if (nlh == NULL) /* shouldn't really happen ... */
                 return -EMSGSIZE;
 
         f = nlmsg_data(nlh);
@@ -934,7 +954,7 @@ static int build_sadinfo(struct sk_buff *skb, struct net *net,
         u32 *f;
 
         nlh = nlmsg_put(skb, pid, seq, XFRM_MSG_NEWSADINFO, sizeof(u32), 0);
-        if (nlh == NULL) /* shouldnt really happen ... */
+        if (nlh == NULL) /* shouldn't really happen ... */
                 return -EMSGSIZE;
 
         f = nlmsg_data(nlh);
@@ -1341,7 +1361,7 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (!xp)
                 return err;
 
-        /* shouldnt excl be based on nlh flags??
+        /* shouldn't excl be based on nlh flags??
          * Aha! this is anti-netlink really i.e  more pfkey derived
          * in netlink excl is a flag and you wouldnt need
          * a type XFRM_MSG_UPDPOLICY - JHS */
@@ -1766,6 +1786,10 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (x->km.state != XFRM_STATE_VALID)
                 goto out;
 
+        err = xfrm_replay_verify_len(x->replay_esn, rp);
+        if (err)
+                goto out;
+
         spin_lock_bh(&x->lock);
         xfrm_update_ae_params(x, attrs);
         spin_unlock_bh(&x->lock);