| From 3f29770723fe498a5c5f57c3a31a996ebdde03e1 Mon Sep 17 00:00:00 2001 |
| From: "Jason A. Donenfeld" <Jason@zx2c4.com> |
| Date: Sun, 4 Jun 2017 04:16:23 +0200 |
| Subject: ipsec: check return value of skb_to_sgvec always |
| |
| From: Jason A. Donenfeld <Jason@zx2c4.com> |
| |
| commit 3f29770723fe498a5c5f57c3a31a996ebdde03e1 upstream. |
| |
| Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> |
| Cc: Steffen Klassert <steffen.klassert@secunet.com> |
| Cc: Herbert Xu <herbert@gondor.apana.org.au> |
| Cc: "David S. Miller" <davem@davemloft.net> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| [natechancellor: Adjusted context due to lack of fca11ebde3f0] |
| Signed-off-by: Nathan Chancellor <natechancellor@gmail.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/ipv4/ah4.c | 8 ++++++-- |
| net/ipv4/esp4.c | 13 ++++++++----- |
| net/ipv6/ah6.c | 8 ++++++-- |
| net/ipv6/esp6.c | 12 ++++++++---- |
| 4 files changed, 28 insertions(+), 13 deletions(-) |
| |
| --- a/net/ipv4/ah4.c |
| +++ b/net/ipv4/ah4.c |
| @@ -220,7 +220,9 @@ static int ah_output(struct xfrm_state * |
| ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low); |
| |
| sg_init_table(sg, nfrags + sglists); |
| - skb_to_sgvec_nomark(skb, sg, 0, skb->len); |
| + err = skb_to_sgvec_nomark(skb, sg, 0, skb->len); |
| + if (unlikely(err < 0)) |
| + goto out_free; |
| |
| if (x->props.flags & XFRM_STATE_ESN) { |
| /* Attach seqhi sg right after packet payload */ |
| @@ -393,7 +395,9 @@ static int ah_input(struct xfrm_state *x |
| skb_push(skb, ihl); |
| |
| sg_init_table(sg, nfrags + sglists); |
| - skb_to_sgvec_nomark(skb, sg, 0, skb->len); |
| + err = skb_to_sgvec_nomark(skb, sg, 0, skb->len); |
| + if (unlikely(err < 0)) |
| + goto out_free; |
| |
| if (x->props.flags & XFRM_STATE_ESN) { |
| /* Attach seqhi sg right after packet payload */ |
| --- a/net/ipv4/esp4.c |
| +++ b/net/ipv4/esp4.c |
| @@ -268,10 +268,11 @@ static int esp_output(struct xfrm_state |
| esph->spi = x->id.spi; |
| |
| sg_init_table(sg, nfrags); |
| - skb_to_sgvec(skb, sg, |
| - (unsigned char *)esph - skb->data, |
| - assoclen + ivlen + clen + alen); |
| - |
| + err = skb_to_sgvec(skb, sg, |
| + (unsigned char *)esph - skb->data, |
| + assoclen + ivlen + clen + alen); |
| + if (unlikely(err < 0)) |
| + goto error; |
| aead_request_set_crypt(req, sg, sg, ivlen + clen, iv); |
| aead_request_set_ad(req, assoclen); |
| |
| @@ -481,7 +482,9 @@ static int esp_input(struct xfrm_state * |
| } |
| |
| sg_init_table(sg, nfrags); |
| - skb_to_sgvec(skb, sg, 0, skb->len); |
| + err = skb_to_sgvec(skb, sg, 0, skb->len); |
| + if (unlikely(err < 0)) |
| + goto out; |
| |
| aead_request_set_crypt(req, sg, sg, elen + ivlen, iv); |
| aead_request_set_ad(req, assoclen); |
| --- a/net/ipv6/ah6.c |
| +++ b/net/ipv6/ah6.c |
| @@ -423,7 +423,9 @@ static int ah6_output(struct xfrm_state |
| ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low); |
| |
| sg_init_table(sg, nfrags + sglists); |
| - skb_to_sgvec_nomark(skb, sg, 0, skb->len); |
| + err = skb_to_sgvec_nomark(skb, sg, 0, skb->len); |
| + if (unlikely(err < 0)) |
| + goto out_free; |
| |
| if (x->props.flags & XFRM_STATE_ESN) { |
| /* Attach seqhi sg right after packet payload */ |
| @@ -603,7 +605,9 @@ static int ah6_input(struct xfrm_state * |
| ip6h->hop_limit = 0; |
| |
| sg_init_table(sg, nfrags + sglists); |
| - skb_to_sgvec_nomark(skb, sg, 0, skb->len); |
| + err = skb_to_sgvec_nomark(skb, sg, 0, skb->len); |
| + if (unlikely(err < 0)) |
| + goto out_free; |
| |
| if (x->props.flags & XFRM_STATE_ESN) { |
| /* Attach seqhi sg right after packet payload */ |
| --- a/net/ipv6/esp6.c |
| +++ b/net/ipv6/esp6.c |
| @@ -248,9 +248,11 @@ static int esp6_output(struct xfrm_state |
| esph->spi = x->id.spi; |
| |
| sg_init_table(sg, nfrags); |
| - skb_to_sgvec(skb, sg, |
| - (unsigned char *)esph - skb->data, |
| - assoclen + ivlen + clen + alen); |
| + err = skb_to_sgvec(skb, sg, |
| + (unsigned char *)esph - skb->data, |
| + assoclen + ivlen + clen + alen); |
| + if (unlikely(err < 0)) |
| + goto error; |
| |
| aead_request_set_crypt(req, sg, sg, ivlen + clen, iv); |
| aead_request_set_ad(req, assoclen); |
| @@ -423,7 +425,9 @@ static int esp6_input(struct xfrm_state |
| } |
| |
| sg_init_table(sg, nfrags); |
| - skb_to_sgvec(skb, sg, 0, skb->len); |
| + ret = skb_to_sgvec(skb, sg, 0, skb->len); |
| + if (unlikely(ret < 0)) |
| + goto out; |
| |
| aead_request_set_crypt(req, sg, sg, elen + ivlen, iv); |
| aead_request_set_ad(req, assoclen); |