esp: Fix possible buffer overflow in ESP transformation
authorSteffen Klassert <steffen.klassert@secunet.com>
Mon, 7 Mar 2022 12:11:39 +0000 (13:11 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 16 Mar 2022 13:23:36 +0000 (14:23 +0100)
commit4aaabbffc3b0658ce80eebdde9bafa20a3f932e0
treef8b5d59e667b6c10d41c298a646e8a443f8fe9cd
parent4dfa7d3508bf8e1187c2d9560eed183dd139c4fc
esp: Fix possible buffer overflow in ESP transformation

[ Upstream commit ebe48d368e97d007bfeb76fcb065d6cfc4c96645 ]

The maximum message size that can be send is bigger than
the  maximum site that skb_page_frag_refill can allocate.
So it is possible to write beyond the allocated buffer.

Fix this by doing a fallback to COW in that case.

v2:

Avoid get get_order() costs as suggested by Linus Torvalds.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Reported-by: valis <sec@valis.email>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
include/net/esp.h
net/ipv4/esp4.c
net/ipv6/esp6.c