linux-stable.git/net/ipv4/esp4.c, branch linux-4.14.y

net: ipv4: fix return value check in esp_remove_trailer

2023-10-25T09:13:31+00:00

commit 513f61e2193350c7a345da98559b80f61aec4fa6 upstream.

In esp_remove_trailer(), to avoid an unexpected result returned by
pskb_trim, we should check the return value of pskb_trim().

Signed-off-by: Ma Ke 
Signed-off-by: Steffen Klassert 
Signed-off-by: Greg Kroah-Hartman

esp: limit skb_page_frag_refill use to a single page

2022-07-12T14:27:27+00:00

commit 5bd8baab087dff657e05387aee802e70304cc813 upstream.

Commit ebe48d368e97 ("esp: Fix possible buffer overflow in ESP
transformation") tried to fix skb_page_frag_refill usage in ESP by
capping allocsize to 32k, but that doesn't completely solve the issue,
as skb_page_frag_refill may return a single page. If that happens, we
will write out of bounds, despite the check introduced in the previous
patch.

This patch forces COW in cases where we would end up calling
skb_page_frag_refill with a size larger than a page (first in
esp_output_head with tailen, then in esp_output_tail with
skb->data_len).

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Sabrina Dubroca 
Signed-off-by: Steffen Klassert 
Signed-off-by: Greg Kroah-Hartman

esp: Fix possible buffer overflow in ESP transformation

2022-03-28T06:22:26+00:00

commit ebe48d368e97d007bfeb76fcb065d6cfc4c96645 upstream.

The maximum message size that can be send is bigger than
the  maximum site that skb_page_frag_refill can allocate.
So it is possible to write beyond the allocated buffer.

Fix this by doing a fallback to COW in that case.

v2:

Avoid get get_order() costs as suggested by Linus Torvalds.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Reported-by: valis 
Signed-off-by: Steffen Klassert 
Signed-off-by: Vaibhav Rustagi 
Signed-off-by: Greg Kroah-Hartman

esp: avoid unneeded kmap_atomic call

2021-01-23T14:48:46+00:00

[ Upstream commit 9bd6b629c39e3fa9e14243a6d8820492be1a5b2e ]

esp(6)_output_head uses skb_page_frag_refill to allocate a buffer for
the esp trailer.

It accesses the page with kmap_atomic to handle highmem. But
skb_page_frag_refill can return compound pages, of which
kmap_atomic only maps the first underlying page.

skb_page_frag_refill does not return highmem, because flag
__GFP_HIGHMEM is not set. ESP uses it in the same manner as TCP.
That also does not call kmap_atomic, but directly uses page_address,
in skb_copy_to_page_nocache. Do the same for ESP.

This issue has become easier to trigger with recent kmap local
debugging feature CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Willem de Bruijn 
Acked-by: Steffen Klassert 
Signed-off-by: Jakub Kicinski 
Signed-off-by: Greg Kroah-Hartman

esp4: add length check for UDP encapsulation

2019-05-25T16:25:34+00:00

[ Upstream commit 8dfb4eba4100e7cdd161a8baef2d8d61b7a7e62e ]

esp_output_udp_encap can produce a length that doesn't fit in the 16
bits of a UDP header's length field. In that case, we'll send a
fragmented packet whose length is larger than IP_MAX_MTU (resulting in
"Oversized IP packet" warnings on receive) and with a bogus UDP
length.

To prevent this, add a length check to esp_output_udp_encap and return
 -EMSGSIZE on failure.

This seems to be older than git history.

Signed-off-by: Sabrina Dubroca 
Signed-off-by: Steffen Klassert 
Signed-off-by: Sasha Levin

esp: Skip TX bytes accounting when sending from a request socket

2019-03-23T13:35:14+00:00

[ Upstream commit 09db51241118aeb06e1c8cd393b45879ce099b36 ]

On ESP output, sk_wmem_alloc is incremented for the added padding if a
socket is associated to the skb. When replying with TCP SYNACKs over
IPsec, the associated sk is a casted request socket, only. Increasing
sk_wmem_alloc on a request socket results in a write at an arbitrary
struct offset. In the best case, this produces the following WARNING:

WARNING: CPU: 1 PID: 0 at lib/refcount.c:102 esp_output_head+0x2e4/0x308 [esp4]
refcount_t: addition on 0; use-after-free.
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.0.0-rc3 #2
Hardware name: Marvell Armada 380/385 (Device Tree)
[...]
[] (esp_output_head [esp4]) from [] (esp_output+0xb8/0x180 [esp4])
[] (esp_output [esp4]) from [] (xfrm_output_resume+0x558/0x664)
[] (xfrm_output_resume) from [] (xfrm4_output+0x44/0xc4)
[] (xfrm4_output) from [] (tcp_v4_send_synack+0xa8/0xe8)
[] (tcp_v4_send_synack) from [] (tcp_conn_request+0x7f4/0x948)
[] (tcp_conn_request) from [] (tcp_rcv_state_process+0x2a0/0xe64)
[] (tcp_rcv_state_process) from [] (tcp_v4_do_rcv+0xf0/0x1f4)
[] (tcp_v4_do_rcv) from [] (tcp_v4_rcv+0xdb8/0xe20)
[] (tcp_v4_rcv) from [] (ip_protocol_deliver_rcu+0x2c/0x2dc)
[] (ip_protocol_deliver_rcu) from [] (ip_local_deliver_finish+0x48/0x54)
[] (ip_local_deliver_finish) from [] (ip_local_deliver+0x54/0xec)
[] (ip_local_deliver) from [] (ip_rcv+0x48/0xb8)
[] (ip_rcv) from [] (__netif_receive_skb_one_core+0x50/0x6c)
[...]

The issue triggers only when not using TCP syncookies, as for syncookies
no socket is associated.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Martin Willi 
Signed-off-by: Steffen Klassert 
Signed-off-by: Sasha Levin

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-09-02T00:42:05+00:00

Three cases of simple overlapping changes.

Signed-off-by: David S. Miller

xfrm: Add support for network devices capable of removing the ESP trailer

2017-08-31T07:04:03+00:00

In conjunction with crypto offload [1], removing the ESP trailer by
hardware can potentially improve the performance by avoiding (1) a
cache miss incurred by reading the nexthdr field and (2) the necessity
to calculate the csum value of the trailer in order to keep skb->csum
valid.

This patch introduces the changes to the xfrm stack and merely serves
as an infrastructure. Subsequent patch to mlx5 driver will put this to
a good use.

[1] https://www.mail-archive.com/netdev@vger.kernel.org/msg175733.html

Signed-off-by: Yossi Kuperman 
Signed-off-by: Steffen Klassert

esp: Fix skb tailroom calculation

2017-08-25T07:26:24+00:00

We use skb_availroom to calculate the skb tailroom for the
ESP trailer. skb_availroom calculates the tailroom and
subtracts this value by reserved_tailroom. However
reserved_tailroom is a union with the skb mark. This means
that we subtract the tailroom by the skb mark if set.
Fix this by using skb_tailroom instead.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Steffen Klassert

esp: Fix locking on page fragment allocation

2017-08-25T07:26:12+00:00

We allocate the page fragment for the ESP trailer inside
a spinlock, but consume it outside of the lock. This
is racy as some other cou could get the same page fragment
then. Fix this by consuming the page fragment inside the
lock too.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Steffen Klassert