esp: Fix possible buffer overflow in ESP transformation
authorSteffen Klassert <steffen.klassert@secunet.com>
Mon, 7 Mar 2022 12:11:39 +0000 (13:11 +0100)
committerSteffen Klassert <steffen.klassert@secunet.com>
Mon, 7 Mar 2022 12:14:03 +0000 (13:14 +0100)
commitebe48d368e97d007bfeb76fcb065d6cfc4c96645
treeeaf068b3acda81ceaad0143fed5851d21a5e8bef
parenta3d9001b4e287fc043e5539d03d71a32ab114bcb
esp: Fix possible buffer overflow in ESP transformation

The maximum message size that can be send is bigger than
the  maximum site that skb_page_frag_refill can allocate.
So it is possible to write beyond the allocated buffer.

Fix this by doing a fallback to COW in that case.

v2:

Avoid get get_order() costs as suggested by Linus Torvalds.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Reported-by: valis <sec@valis.email>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
include/net/esp.h
net/ipv4/esp4.c
net/ipv6/esp6.c