ef6f83df12
commit 5bd8baab087dff657e05387aee802e70304cc813 upstream.
Commit ebe48d368e97 ("esp: Fix possible buffer overflow in ESP
transformation") tried to fix skb_page_frag_refill usage in ESP by
capping allocsize to 32k, but that doesn't completely solve the issue,
as skb_page_frag_refill may return a single page. If that happens, we
will write out of bounds, despite the check introduced in the previous
patch.
This patch forces COW in cases where we would end up calling
skb_page_frag_refill with a size larger than a page (first in
esp_output_head with tailen, then in esp_output_tail with
skb->data_len).
Fixes: cac2661c53 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
34 lines
877 B
C
34 lines
877 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _NET_ESP_H
|
|
#define _NET_ESP_H
|
|
|
|
#include <linux/skbuff.h>
|
|
|
|
struct ip_esp_hdr;
|
|
|
|
static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb)
|
|
{
|
|
return (struct ip_esp_hdr *)skb_transport_header(skb);
|
|
}
|
|
|
|
struct esp_info {
|
|
struct ip_esp_hdr *esph;
|
|
__be64 seqno;
|
|
int tfclen;
|
|
int tailen;
|
|
int plen;
|
|
int clen;
|
|
int len;
|
|
int nfrags;
|
|
__u8 proto;
|
|
bool inplace;
|
|
};
|
|
|
|
int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp);
|
|
int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp);
|
|
int esp_input_done2(struct sk_buff *skb, int err);
|
|
int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp);
|
|
int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp);
|
|
int esp6_input_done2(struct sk_buff *skb, int err);
|
|
#endif
|