1 files changed, 232 insertions, 40 deletions

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index b95a2d64eb59..6106b72826d3 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -62,6 +62,22 @@ static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
         return 0;
 }
 
+static int verify_auth_trunc(struct nlattr **attrs)
+{
+        struct nlattr *rt = attrs[XFRMA_ALG_AUTH_TRUNC];
+        struct xfrm_algo_auth *algp;
+
+        if (!rt)
+                return 0;
+
+        algp = nla_data(rt);
+        if (nla_len(rt) < xfrm_alg_auth_len(algp))
+                return -EINVAL;
+
+        algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
+        return 0;
+}
+
 static int verify_aead(struct nlattr **attrs)
 {
         struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
@@ -128,7 +144,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
         err = -EINVAL;
         switch (p->id.proto) {
         case IPPROTO_AH:
-                if (!attrs[XFRMA_ALG_AUTH]      ||
+                if ((!attrs[XFRMA_ALG_AUTH]     &&
+                     !attrs[XFRMA_ALG_AUTH_TRUNC]) ||
                     attrs[XFRMA_ALG_AEAD]       ||
                     attrs[XFRMA_ALG_CRYPT]      ||
                     attrs[XFRMA_ALG_COMP])
@@ -139,10 +156,12 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
                 if (attrs[XFRMA_ALG_COMP])
                         goto out;
                 if (!attrs[XFRMA_ALG_AUTH] &&
+                    !attrs[XFRMA_ALG_AUTH_TRUNC] &&
                     !attrs[XFRMA_ALG_CRYPT] &&
                     !attrs[XFRMA_ALG_AEAD])
                         goto out;
                 if ((attrs[XFRMA_ALG_AUTH] ||
+                     attrs[XFRMA_ALG_AUTH_TRUNC] ||
                      attrs[XFRMA_ALG_CRYPT]) &&
                     attrs[XFRMA_ALG_AEAD])
                         goto out;
@@ -152,6 +171,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
                 if (!attrs[XFRMA_ALG_COMP]      ||
                     attrs[XFRMA_ALG_AEAD]       ||
                     attrs[XFRMA_ALG_AUTH]       ||
+                    attrs[XFRMA_ALG_AUTH_TRUNC] ||
                     attrs[XFRMA_ALG_CRYPT])
                         goto out;
                 break;
@@ -161,6 +181,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
         case IPPROTO_ROUTING:
                 if (attrs[XFRMA_ALG_COMP]       ||
                     attrs[XFRMA_ALG_AUTH]       ||
+                    attrs[XFRMA_ALG_AUTH_TRUNC] ||
                     attrs[XFRMA_ALG_AEAD]       ||
                     attrs[XFRMA_ALG_CRYPT]      ||
                     attrs[XFRMA_ENCAP]          ||
@@ -176,6 +197,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
 
         if ((err = verify_aead(attrs)))
                 goto out;
+        if ((err = verify_auth_trunc(attrs)))
+                goto out;
         if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
                 goto out;
         if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
@@ -229,6 +252,66 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
         return 0;
 }
 
+static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props,
+                       struct nlattr *rta)
+{
+        struct xfrm_algo *ualg;
+        struct xfrm_algo_auth *p;
+        struct xfrm_algo_desc *algo;
+
+        if (!rta)
+                return 0;
+
+        ualg = nla_data(rta);
+
+        algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
+        if (!algo)
+                return -ENOSYS;
+        *props = algo->desc.sadb_alg_id;
+
+        p = kmalloc(sizeof(*p) + (ualg->alg_key_len + 7) / 8, GFP_KERNEL);
+        if (!p)
+                return -ENOMEM;
+
+        strcpy(p->alg_name, algo->name);
+        p->alg_key_len = ualg->alg_key_len;
+        p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
+        memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);
+
+        *algpp = p;
+        return 0;
+}
+
+static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
+                             struct nlattr *rta)
+{
+        struct xfrm_algo_auth *p, *ualg;
+        struct xfrm_algo_desc *algo;
+
+        if (!rta)
+                return 0;
+
+        ualg = nla_data(rta);
+
+        algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
+        if (!algo)
+                return -ENOSYS;
+        if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
+                return -EINVAL;
+        *props = algo->desc.sadb_alg_id;
+
+        p = kmemdup(ualg, xfrm_alg_auth_len(ualg), GFP_KERNEL);
+        if (!p)
+                return -ENOMEM;
+
+        strcpy(p->alg_name, algo->name);
+        if (!p->alg_trunc_len)
+                p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
+
+        *algpp = p;
+        return 0;
+}
+
 static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props,
                        struct nlattr *rta)
 {
@@ -332,10 +415,14 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
         if ((err = attach_aead(&x->aead, &x->props.ealgo,
                                attrs[XFRMA_ALG_AEAD])))
                 goto error;
-        if ((err = attach_one_algo(&x->aalg, &x->props.aalgo,
-                                   xfrm_aalg_get_byname,
-                                   attrs[XFRMA_ALG_AUTH])))
+        if ((err = attach_auth_trunc(&x->aalg, &x->props.aalgo,
+                                     attrs[XFRMA_ALG_AUTH_TRUNC])))
                 goto error;
+        if (!x->props.aalgo) {
+                if ((err = attach_auth(&x->aalg, &x->props.aalgo,
+                                       attrs[XFRMA_ALG_AUTH])))
+                        goto error;
+        }
         if ((err = attach_one_algo(&x->ealg, &x->props.ealgo,
                                    xfrm_ealg_get_byname,
                                    attrs[XFRMA_ALG_CRYPT])))
@@ -359,6 +446,8 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
                         goto error;
         }
 
+        xfrm_mark_get(attrs, &x->mark);
+
         err = xfrm_init_state(x);
         if (err)
                 goto error;
@@ -439,11 +528,13 @@ static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
                                                  int *errp)
 {
         struct xfrm_state *x = NULL;
+        struct xfrm_mark m;
         int err;
+        u32 mark = xfrm_mark_get(attrs, &m);
 
         if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) {
                 err = -ESRCH;
-                x = xfrm_state_lookup(net, &p->daddr, p->spi, p->proto, p->family);
+                x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family);
         } else {
                 xfrm_address_t *saddr = NULL;
 
@@ -454,7 +545,8 @@ static struct xfrm_state *xfrm_user_state_lookup(struct net *net,
                 }
 
                 err = -ESRCH;
-                x = xfrm_state_lookup_byaddr(net, &p->daddr, saddr,
+                x = xfrm_state_lookup_byaddr(net, mark,
+                                             &p->daddr, saddr,
                                              p->proto, p->family);
         }
 
@@ -548,6 +640,24 @@ static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
         return 0;
 }
 
+static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
+{
+        struct xfrm_algo *algo;
+        struct nlattr *nla;
+
+        nla = nla_reserve(skb, XFRMA_ALG_AUTH,
+                          sizeof(*algo) + (auth->alg_key_len + 7) / 8);
+        if (!nla)
+                return -EMSGSIZE;
+
+        algo = nla_data(nla);
+        strcpy(algo->alg_name, auth->alg_name);
+        memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
+        algo->alg_key_len = auth->alg_key_len;
+
+        return 0;
+}
+
 /* Don't change this without updating xfrm_sa_len! */
 static int copy_to_user_state_extra(struct xfrm_state *x,
                                     struct xfrm_usersa_info *p,
@@ -563,8 +673,13 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
 
         if (x->aead)
                 NLA_PUT(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead);
-        if (x->aalg)
-                NLA_PUT(skb, XFRMA_ALG_AUTH, xfrm_alg_len(x->aalg), x->aalg);
+        if (x->aalg) {
+                if (copy_to_user_auth(x->aalg, skb))
+                        goto nla_put_failure;
+
+                NLA_PUT(skb, XFRMA_ALG_AUTH_TRUNC,
+                        xfrm_alg_auth_len(x->aalg), x->aalg);
+        }
         if (x->ealg)
                 NLA_PUT(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
         if (x->calg)
@@ -573,6 +688,9 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
         if (x->encap)
                 NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
 
+        if (xfrm_mark_put(skb, &x->mark))
+                goto nla_put_failure;
+
         if (x->security && copy_sec_ctx(x->security, skb) < 0)
                 goto nla_put_failure;
 
@@ -671,7 +789,8 @@ static inline size_t xfrm_spdinfo_msgsize(void)
                + nla_total_size(sizeof(struct xfrmu_spdhinfo));
 }
 
-static int build_spdinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
+static int build_spdinfo(struct sk_buff *skb, struct net *net,
+                         u32 pid, u32 seq, u32 flags)
 {
         struct xfrmk_spdinfo si;
         struct xfrmu_spdinfo spc;
@@ -685,7 +804,7 @@ static int build_spdinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
 
         f = nlmsg_data(nlh);
         *f = flags;
-        xfrm_spd_getinfo(&si);
+        xfrm_spd_getinfo(net, &si);
         spc.incnt = si.incnt;
         spc.outcnt = si.outcnt;
         spc.fwdcnt = si.fwdcnt;
@@ -718,7 +837,7 @@ static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (r_skb == NULL)
                 return -ENOMEM;
 
-        if (build_spdinfo(r_skb, spid, seq, *flags) < 0)
+        if (build_spdinfo(r_skb, net, spid, seq, *flags) < 0)
                 BUG();
 
         return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
@@ -731,7 +850,8 @@ static inline size_t xfrm_sadinfo_msgsize(void)
                + nla_total_size(4); /* XFRMA_SAD_CNT */
 }
 
-static int build_sadinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
+static int build_sadinfo(struct sk_buff *skb, struct net *net,
+                         u32 pid, u32 seq, u32 flags)
 {
         struct xfrmk_sadinfo si;
         struct xfrmu_sadhinfo sh;
@@ -744,7 +864,7 @@ static int build_sadinfo(struct sk_buff *skb, u32 pid, u32 seq, u32 flags)
 
         f = nlmsg_data(nlh);
         *f = flags;
-        xfrm_sad_getinfo(&si);
+        xfrm_sad_getinfo(net, &si);
 
         sh.sadhmcnt = si.sadhmcnt;
         sh.sadhcnt = si.sadhcnt;
@@ -772,7 +892,7 @@ static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (r_skb == NULL)
                 return -ENOMEM;
 
-        if (build_sadinfo(r_skb, spid, seq, *flags) < 0)
+        if (build_sadinfo(r_skb, net, spid, seq, *flags) < 0)
                 BUG();
 
         return nlmsg_unicast(net->xfrm.nlsk, r_skb, spid);
@@ -835,6 +955,8 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
         xfrm_address_t *daddr;
         int family;
         int err;
+        u32 mark;
+        struct xfrm_mark m;
 
         p = nlmsg_data(nlh);
         err = verify_userspi_info(p);
@@ -845,8 +967,10 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
         daddr = &p->info.id.daddr;
 
         x = NULL;
+
+        mark = xfrm_mark_get(attrs, &m);
         if (p->info.seq) {
-                x = xfrm_find_acq_byseq(net, p->info.seq);
+                x = xfrm_find_acq_byseq(net, mark, p->info.seq);
                 if (x && xfrm_addr_cmp(&x->id.daddr, daddr, family)) {
                         xfrm_state_put(x);
                         x = NULL;
@@ -854,7 +978,7 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
         }
 
         if (!x)
-                x = xfrm_find_acq(net, p->info.mode, p->info.reqid,
+                x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid,
                                   p->info.id.proto, daddr,
                                   &p->info.saddr, 1,
                                   family);
@@ -1108,6 +1232,8 @@ static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_us
         if (err)
                 goto error;
 
+        xfrm_mark_get(attrs, &xp->mark);
+
         return xp;
  error:
         *errp = err;
@@ -1254,10 +1380,13 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
                 goto nlmsg_failure;
         if (copy_to_user_policy_type(xp->type, skb) < 0)
                 goto nlmsg_failure;
+        if (xfrm_mark_put(skb, &xp->mark))
+                goto nla_put_failure;
 
         nlmsg_end(skb, nlh);
         return 0;
 
+nla_put_failure:
 nlmsg_failure:
         nlmsg_cancel(skb, nlh);
         return -EMSGSIZE;
@@ -1329,6 +1458,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
         int err;
         struct km_event c;
         int delete;
+        struct xfrm_mark m;
+        u32 mark = xfrm_mark_get(attrs, &m);
 
         p = nlmsg_data(nlh);
         delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
@@ -1342,7 +1473,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                 return err;
 
         if (p->index)
-                xp = xfrm_policy_byid(net, type, p->dir, p->index, delete, &err);
+                xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, delete, &err);
         else {
                 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
                 struct xfrm_sec_ctx *ctx;
@@ -1359,8 +1490,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                         if (err)
                                 return err;
                 }
-                xp = xfrm_policy_bysel_ctx(net, type, p->dir, &p->sel, ctx,
-                                           delete, &err);
+                xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir, &p->sel,
+                                           ctx, delete, &err);
                 security_xfrm_policy_free(ctx);
         }
         if (xp == NULL)
@@ -1412,8 +1543,11 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
         audit_info.sessionid = NETLINK_CB(skb).sessionid;
         audit_info.secid = NETLINK_CB(skb).sid;
         err = xfrm_state_flush(net, p->proto, &audit_info);
-        if (err)
+        if (err) {
+                if (err == -ESRCH) /* empty table */
+                        return 0;
                 return err;
+        }
         c.data.proto = p->proto;
         c.event = nlh->nlmsg_type;
         c.seq = nlh->nlmsg_seq;
@@ -1429,6 +1563,7 @@ static inline size_t xfrm_aevent_msgsize(void)
         return NLMSG_ALIGN(sizeof(struct xfrm_aevent_id))
                + nla_total_size(sizeof(struct xfrm_replay_state))
                + nla_total_size(sizeof(struct xfrm_lifetime_cur))
+               + nla_total_size(sizeof(struct xfrm_mark))
                + nla_total_size(4) /* XFRM_AE_RTHR */
                + nla_total_size(4); /* XFRM_AE_ETHR */
 }
@@ -1461,6 +1596,9 @@ static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_eve
                 NLA_PUT_U32(skb, XFRMA_ETIMER_THRESH,
                             x->replay_maxage * 10 / HZ);
 
+        if (xfrm_mark_put(skb, &x->mark))
+                goto nla_put_failure;
+
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
@@ -1476,6 +1614,8 @@ static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct sk_buff *r_skb;
         int err;
         struct km_event c;
+        u32 mark;
+        struct xfrm_mark m;
         struct xfrm_aevent_id *p = nlmsg_data(nlh);
         struct xfrm_usersa_id *id = &p->sa_id;
 
@@ -1483,7 +1623,9 @@ static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (r_skb == NULL)
                 return -ENOMEM;
 
-        x = xfrm_state_lookup(net, &id->daddr, id->spi, id->proto, id->family);
+        mark = xfrm_mark_get(attrs, &m);
+
+        x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family);
         if (x == NULL) {
                 kfree_skb(r_skb);
                 return -ESRCH;
@@ -1514,6 +1656,8 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct xfrm_state *x;
         struct km_event c;
         int err = - EINVAL;
+        u32 mark = 0;
+        struct xfrm_mark m;
         struct xfrm_aevent_id *p = nlmsg_data(nlh);
         struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
         struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
@@ -1525,7 +1669,9 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (!(nlh->nlmsg_flags&NLM_F_REPLACE))
                 return err;
 
-        x = xfrm_state_lookup(net, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
+        mark = xfrm_mark_get(attrs, &m);
+
+        x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family);
         if (x == NULL)
                 return -ESRCH;
 
@@ -1564,8 +1710,12 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
         audit_info.sessionid = NETLINK_CB(skb).sessionid;
         audit_info.secid = NETLINK_CB(skb).sid;
         err = xfrm_policy_flush(net, type, &audit_info);
-        if (err)
+        if (err) {
+                if (err == -ESRCH) /* empty table */
+                        return 0;
                 return err;
+        }
+
         c.data.type = type;
         c.event = nlh->nlmsg_type;
         c.seq = nlh->nlmsg_seq;
@@ -1584,13 +1734,15 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct xfrm_userpolicy_info *p = &up->pol;
         u8 type = XFRM_POLICY_TYPE_MAIN;
         int err = -ENOENT;
+        struct xfrm_mark m;
+        u32 mark = xfrm_mark_get(attrs, &m);
 
         err = copy_from_user_policy_type(&type, attrs);
         if (err)
                 return err;
 
         if (p->index)
-                xp = xfrm_policy_byid(net, type, p->dir, p->index, 0, &err);
+                xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err);
         else {
                 struct nlattr *rt = attrs[XFRMA_SEC_CTX];
                 struct xfrm_sec_ctx *ctx;
@@ -1607,7 +1759,8 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
                         if (err)
                                 return err;
                 }
-                xp = xfrm_policy_bysel_ctx(net, type, p->dir, &p->sel, ctx, 0, &err);
+                xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir,
+                                           &p->sel, ctx, 0, &err);
                 security_xfrm_policy_free(ctx);
         }
         if (xp == NULL)
@@ -1647,8 +1800,10 @@ static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
         int err;
         struct xfrm_user_expire *ue = nlmsg_data(nlh);
         struct xfrm_usersa_info *p = &ue->state;
+        struct xfrm_mark m;
+        u32 mark = xfrm_mark_get(attrs, &m);;
 
-        x = xfrm_state_lookup(net, &p->id.daddr, p->id.spi, p->id.proto, p->family);
+        x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);
 
         err = -ENOENT;
         if (x == NULL)
@@ -1682,6 +1837,7 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct xfrm_user_tmpl *ut;
         int i;
         struct nlattr *rt = attrs[XFRMA_TMPL];
+        struct xfrm_mark mark;
 
         struct xfrm_user_acquire *ua = nlmsg_data(nlh);
         struct xfrm_state *x = xfrm_state_alloc(net);
@@ -1690,6 +1846,8 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (!x)
                 goto nomem;
 
+        xfrm_mark_get(attrs, &mark);
+
         err = verify_newpolicy_info(&ua->policy);
         if (err)
                 goto bad_policy;
@@ -1702,7 +1860,8 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
         memcpy(&x->id, &ua->id, sizeof(ua->id));
         memcpy(&x->props.saddr, &ua->saddr, sizeof(ua->saddr));
         memcpy(&x->sel, &ua->sel, sizeof(ua->sel));
-
+        xp->mark.m = x->mark.m = mark.m;
+        xp->mark.v = x->mark.v = mark.v;
         ut = nla_data(rt);
         /* extract the templates and for each call km_key */
         for (i = 0; i < xp->xfrm_nr; i++, ut++) {
@@ -1942,6 +2101,10 @@ static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
 #undef XMSGSIZE
 
 static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
+        [XFRMA_SA]              = { .len = sizeof(struct xfrm_usersa_info)},
+        [XFRMA_POLICY]          = { .len = sizeof(struct xfrm_userpolicy_info)},
+        [XFRMA_LASTUSED]        = { .type = NLA_U64},
+        [XFRMA_ALG_AUTH_TRUNC]  = { .len = sizeof(struct xfrm_algo_auth)},
         [XFRMA_ALG_AEAD]        = { .len = sizeof(struct xfrm_algo_aead) },
         [XFRMA_ALG_AUTH]        = { .len = sizeof(struct xfrm_algo) },
         [XFRMA_ALG_CRYPT]       = { .len = sizeof(struct xfrm_algo) },
@@ -1958,6 +2121,7 @@ static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
         [XFRMA_POLICY_TYPE]     = { .len = sizeof(struct xfrm_userpolicy_type)},
         [XFRMA_MIGRATE]         = { .len = sizeof(struct xfrm_user_migrate) },
         [XFRMA_KMADDRESS]       = { .len = sizeof(struct xfrm_user_kmaddress) },
+        [XFRMA_MARK]            = { .len = sizeof(struct xfrm_mark) },
 };
 
 static struct xfrm_link {
@@ -2037,7 +2201,8 @@ static void xfrm_netlink_rcv(struct sk_buff *skb)
 
 static inline size_t xfrm_expire_msgsize(void)
 {
-        return NLMSG_ALIGN(sizeof(struct xfrm_user_expire));
+        return NLMSG_ALIGN(sizeof(struct xfrm_user_expire))
+               + nla_total_size(sizeof(struct xfrm_mark));
 }
 
 static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_event *c)
@@ -2053,7 +2218,13 @@ static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_eve
         copy_to_user_state(x, &ue->state);
         ue->hard = (c->data.hard != 0) ? 1 : 0;
 
+        if (xfrm_mark_put(skb, &x->mark))
+                goto nla_put_failure;
+
         return nlmsg_end(skb, nlh);
+
+nla_put_failure:
+        return -EMSGSIZE;
 }
 
 static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c)
@@ -2065,8 +2236,10 @@ static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c)
         if (skb == NULL)
                 return -ENOMEM;
 
-        if (build_expire(skb, x, c) < 0)
-                BUG();
+        if (build_expire(skb, x, c) < 0) {
+                kfree_skb(skb);
+                return -EMSGSIZE;
+        }
 
         return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
 }
@@ -2117,8 +2290,11 @@ static inline size_t xfrm_sa_len(struct xfrm_state *x)
         size_t l = 0;
         if (x->aead)
                 l += nla_total_size(aead_len(x->aead));
-        if (x->aalg)
-                l += nla_total_size(xfrm_alg_len(x->aalg));
+        if (x->aalg) {
+                l += nla_total_size(sizeof(struct xfrm_algo) +
+                                    (x->aalg->alg_key_len + 7) / 8);
+                l += nla_total_size(xfrm_alg_auth_len(x->aalg));
+        }
         if (x->ealg)
                 l += nla_total_size(xfrm_alg_len(x->ealg));
         if (x->calg)
@@ -2151,6 +2327,7 @@ static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c)
         if (c->event == XFRM_MSG_DELSA) {
                 len += nla_total_size(headlen);
                 headlen = sizeof(*id);
+                len += nla_total_size(sizeof(struct xfrm_mark));
         }
         len += NLMSG_ALIGN(headlen);
 
@@ -2221,6 +2398,7 @@ static inline size_t xfrm_acquire_msgsize(struct xfrm_state *x,
 {
         return NLMSG_ALIGN(sizeof(struct xfrm_user_acquire))
                + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
+               + nla_total_size(sizeof(struct xfrm_mark))
                + nla_total_size(xfrm_user_sec_ctx_size(x->security))
                + userpolicy_type_attrsize();
 }
@@ -2253,9 +2431,12 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
                 goto nlmsg_failure;
         if (copy_to_user_policy_type(xp->type, skb) < 0)
                 goto nlmsg_failure;
+        if (xfrm_mark_put(skb, &xp->mark))
+                goto nla_put_failure;
 
         return nlmsg_end(skb, nlh);
 
+nla_put_failure:
 nlmsg_failure:
         nlmsg_cancel(skb, nlh);
         return -EMSGSIZE;
@@ -2342,6 +2523,7 @@ static inline size_t xfrm_polexpire_msgsize(struct xfrm_policy *xp)
         return NLMSG_ALIGN(sizeof(struct xfrm_user_polexpire))
                + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
                + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
+               + nla_total_size(sizeof(struct xfrm_mark))
                + userpolicy_type_attrsize();
 }
 
@@ -2364,10 +2546,13 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
                 goto nlmsg_failure;
         if (copy_to_user_policy_type(xp->type, skb) < 0)
                 goto nlmsg_failure;
+        if (xfrm_mark_put(skb, &xp->mark))
+                goto nla_put_failure;
         upe->hard = !!hard;
 
         return nlmsg_end(skb, nlh);
 
+nla_put_failure:
 nlmsg_failure:
         nlmsg_cancel(skb, nlh);
         return -EMSGSIZE;
@@ -2404,6 +2589,7 @@ static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *
                 headlen = sizeof(*id);
         }
         len += userpolicy_type_attrsize();
+        len += nla_total_size(sizeof(struct xfrm_mark));
         len += NLMSG_ALIGN(headlen);
 
         skb = nlmsg_new(len, GFP_ATOMIC);
@@ -2439,10 +2625,14 @@ static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *
         if (copy_to_user_policy_type(xp->type, skb) < 0)
                 goto nlmsg_failure;
 
+        if (xfrm_mark_put(skb, &xp->mark))
+                goto nla_put_failure;
+
         nlmsg_end(skb, nlh);
 
         return nlmsg_multicast(net->xfrm.nlsk, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
 
+nla_put_failure:
 nlmsg_failure:
         kfree_skb(skb);
         return -1;
@@ -2608,22 +2798,24 @@ static int __net_init xfrm_user_net_init(struct net *net)
                                      xfrm_netlink_rcv, NULL, THIS_MODULE);
         if (nlsk == NULL)
                 return -ENOMEM;
+        net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
         rcu_assign_pointer(net->xfrm.nlsk, nlsk);
         return 0;
 }
 
-static void __net_exit xfrm_user_net_exit(struct net *net)
+static void __net_exit xfrm_user_net_exit(struct list_head *net_exit_list)
 {
-        struct sock *nlsk = net->xfrm.nlsk;
-
-        rcu_assign_pointer(net->xfrm.nlsk, NULL);
-        synchronize_rcu();
-        netlink_kernel_release(nlsk);
+        struct net *net;
+        list_for_each_entry(net, net_exit_list, exit_list)
+                rcu_assign_pointer(net->xfrm.nlsk, NULL);
+        synchronize_net();
+        list_for_each_entry(net, net_exit_list, exit_list)
+                netlink_kernel_release(net->xfrm.nlsk_stash);
 }
 
 static struct pernet_operations xfrm_user_net_ops = {
-        .init = xfrm_user_net_init,
-        .exit = xfrm_user_net_exit,
+        .init       = xfrm_user_net_init,
+        .exit_batch = xfrm_user_net_exit,
 };
 
 static int __init xfrm_user_init(void)