Skip to content

Commit 2cc7fb9

Browse files
committed
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
Steffen Klassert says: ==================== pull request (net): ipsec 2022-04-14 1) Fix the output interface for VRF cases in xfrm_dst_lookup. From David Ahern. 2) Fix write out of bounds by doing COW on esp output when the packet size is larger than a page. From Sabrina Dubroca. ==================== Signed-off-by: David S. Miller <[email protected]>
2 parents 29e8e65 + 5bd8baa commit 2cc7fb9

File tree

4 files changed

+7
-9
lines changed

4 files changed

+7
-9
lines changed

include/net/esp.h

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@
44

55
#include <linux/skbuff.h>
66

7-
#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER)
8-
97
struct ip_esp_hdr;
108

119
static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb)

net/ipv4/esp4.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -446,7 +446,6 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
446446
struct page *page;
447447
struct sk_buff *trailer;
448448
int tailen = esp->tailen;
449-
unsigned int allocsz;
450449

451450
/* this is non-NULL only with TCP/UDP Encapsulation */
452451
if (x->encap) {
@@ -456,8 +455,8 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
456455
return err;
457456
}
458457

459-
allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
460-
if (allocsz > ESP_SKB_FRAG_MAXSIZE)
458+
if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE ||
459+
ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE)
461460
goto cow;
462461

463462
if (!skb_cloned(skb)) {

net/ipv6/esp6.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -482,7 +482,6 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
482482
struct page *page;
483483
struct sk_buff *trailer;
484484
int tailen = esp->tailen;
485-
unsigned int allocsz;
486485

487486
if (x->encap) {
488487
int err = esp6_output_encap(x, skb, esp);
@@ -491,8 +490,8 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
491490
return err;
492491
}
493492

494-
allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
495-
if (allocsz > ESP_SKB_FRAG_MAXSIZE)
493+
if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE ||
494+
ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE)
496495
goto cow;
497496

498497
if (!skb_cloned(skb)) {

net/xfrm/xfrm_policy.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2593,12 +2593,14 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
25932593

25942594
if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
25952595
__u32 mark = 0;
2596+
int oif;
25962597

25972598
if (xfrm[i]->props.smark.v || xfrm[i]->props.smark.m)
25982599
mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);
25992600

26002601
family = xfrm[i]->props.family;
2601-
dst = xfrm_dst_lookup(xfrm[i], tos, fl->flowi_oif,
2602+
oif = fl->flowi_oif ? : fl->flowi_l3mdev;
2603+
dst = xfrm_dst_lookup(xfrm[i], tos, oif,
26022604
&saddr, &daddr, family, mark);
26032605
err = PTR_ERR(dst);
26042606
if (IS_ERR(dst))

0 commit comments

Comments
 (0)