mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 17:30:02 +00:00
esp: Fix possible buffer overflow in ESP transformation
commitebe48d368e
upstream. The maximum message size that can be send is bigger than the maximum site that skb_page_frag_refill can allocate. So it is possible to write beyond the allocated buffer. Fix this by doing a fallback to COW in that case. v2: Avoid get get_order() costs as suggested by Linus Torvalds. Fixes:cac2661c53
("esp4: Avoid skb_cow_data whenever possible") Fixes:03e2a30f6a
("esp6: Avoid skb_cow_data whenever possible") Reported-by: valis <sec@valis.email> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Vaibhav Rustagi <vaibhavrustagi@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
5149b89520
commit
2c8abafd6c
5 changed files with 15 additions and 3 deletions
|
@ -4,6 +4,8 @@
|
|||
|
||||
#include <linux/skbuff.h>
|
||||
|
||||
#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER)
|
||||
|
||||
struct ip_esp_hdr;
|
||||
|
||||
static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb)
|
||||
|
|
|
@ -2438,4 +2438,7 @@ extern int sysctl_optmem_max;
|
|||
extern __u32 sysctl_wmem_default;
|
||||
extern __u32 sysctl_rmem_default;
|
||||
|
||||
/* On 32bit arches, an skb frag is limited to 2^15 */
|
||||
#define SKB_FRAG_PAGE_ORDER get_order(32768)
|
||||
|
||||
#endif /* _SOCK_H */
|
||||
|
|
|
@ -2193,9 +2193,6 @@ static void sk_leave_memory_pressure(struct sock *sk)
|
|||
}
|
||||
}
|
||||
|
||||
/* On 32bit arches, an skb frag is limited to 2^15 */
|
||||
#define SKB_FRAG_PAGE_ORDER get_order(32768)
|
||||
|
||||
/**
|
||||
* skb_page_frag_refill - check that a page_frag contains enough room
|
||||
* @sz: minimum size of the fragment we want to get
|
||||
|
|
|
@ -257,6 +257,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
|
|||
struct page *page;
|
||||
struct sk_buff *trailer;
|
||||
int tailen = esp->tailen;
|
||||
unsigned int allocsz;
|
||||
|
||||
/* this is non-NULL only with UDP Encapsulation */
|
||||
if (x->encap) {
|
||||
|
@ -266,6 +267,10 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
|
|||
return err;
|
||||
}
|
||||
|
||||
allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
|
||||
if (allocsz > ESP_SKB_FRAG_MAXSIZE)
|
||||
goto cow;
|
||||
|
||||
if (!skb_cloned(skb)) {
|
||||
if (tailen <= skb_tailroom(skb)) {
|
||||
nfrags = 1;
|
||||
|
|
|
@ -223,6 +223,11 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
|
|||
struct page *page;
|
||||
struct sk_buff *trailer;
|
||||
int tailen = esp->tailen;
|
||||
unsigned int allocsz;
|
||||
|
||||
allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
|
||||
if (allocsz > ESP_SKB_FRAG_MAXSIZE)
|
||||
goto cow;
|
||||
|
||||
if (!skb_cloned(skb)) {
|
||||
if (tailen <= skb_tailroom(skb)) {
|
||||
|
|
Loading…
Reference in a new issue