]> git.baikalelectronics.ru Git - kernel.git/commit
esp: Fix possible buffer overflow in ESP transformation
authorSteffen Klassert <steffen.klassert@secunet.com>
Mon, 7 Mar 2022 12:11:39 +0000 (13:11 +0100)
committerSteffen Klassert <steffen.klassert@secunet.com>
Mon, 7 Mar 2022 12:14:03 +0000 (13:14 +0100)
commit4fef6a73fa7038dbe6f4c46cba2daec204625521
treeeaf068b3acda81ceaad0143fed5851d21a5e8bef
parented4f77d0b63d5ca455325326c724e6d50cbf144e
esp: Fix possible buffer overflow in ESP transformation

The maximum message size that can be send is bigger than
the  maximum site that skb_page_frag_refill can allocate.
So it is possible to write beyond the allocated buffer.

Fix this by doing a fallback to COW in that case.

v2:

Avoid get get_order() costs as suggested by Linus Torvalds.

Fixes: 656a76ddd6dc ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 8c55169a2a32 ("esp6: Avoid skb_cow_data whenever possible")
Reported-by: valis <sec@valis.email>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
include/net/esp.h
net/ipv4/esp4.c
net/ipv6/esp6.c