]> git.baikalelectronics.ru Git - kernel.git/commit
esp: Fix possible buffer overflow in ESP transformation
authorSteffen Klassert <steffen.klassert@secunet.com>
Mon, 7 Mar 2022 12:11:39 +0000 (13:11 +0100)
committerSteffen Klassert <steffen.klassert@secunet.com>
Mon, 7 Mar 2022 12:14:03 +0000 (13:14 +0100)
commitd0656f88c0cf1e1850f53ee0a5c73289b3f7702b
treeeaf068b3acda81ceaad0143fed5851d21a5e8bef
parentd042a11c574f9c7081028be7b2d8e95222942a19
esp: Fix possible buffer overflow in ESP transformation

The maximum message size that can be send is bigger than
the  maximum site that skb_page_frag_refill can allocate.
So it is possible to write beyond the allocated buffer.

Fix this by doing a fallback to COW in that case.

v2:

Avoid get get_order() costs as suggested by Linus Torvalds.

Fixes: 1f6f9496b0f0 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 73a7b070a864 ("esp6: Avoid skb_cow_data whenever possible")
Reported-by: valis <sec@valis.email>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
include/net/esp.h
net/ipv4/esp4.c
net/ipv6/esp6.c