xfrm: prevent high SEQ input in non-ESN mode

[ Upstream commit e3aa43a50a6455831e3c32dabc7ece38d9cd9d05 ]

In non-ESN mode, the SEQ numbers are limited to 32 bits and seq_hi/oseq_hi
are not used. So make sure that user gets proper error message, in case
such assignment occurred.

Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 82a768500999b25459645502ca96704eee355af0..b5266e0848e829358403810963b800f9657306c8 100644 (file)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -178,6 +178,12 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
                                       "Replay seq and seq_hi should be 0 for output SA");
                        return -EINVAL;
                }
+               if (rs->oseq_hi && !(p->flags & XFRM_STATE_ESN)) {
+                       NL_SET_ERR_MSG(
+                               extack,
+                               "Replay oseq_hi should be 0 in non-ESN mode for output SA");
+                       return -EINVAL;
+               }
                if (rs->bmp_len) {
                        NL_SET_ERR_MSG(extack, "Replay bmp_len should 0 for output SA");
                        return -EINVAL;
@@ -190,6 +196,12 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
                                       "Replay oseq and oseq_hi should be 0 for input SA");
                        return -EINVAL;
                }
+               if (rs->seq_hi && !(p->flags & XFRM_STATE_ESN)) {
+                       NL_SET_ERR_MSG(
+                               extack,
+                               "Replay seq_hi should be 0 in non-ESN mode for input SA");
+                       return -EINVAL;
+               }
        }
 
        return 0;