linux-stable.git/net/ipv4/esp4.c, branch linux-4.19.y

net: ipv4: fix return value check in esp_remove_trailer

2023-10-25T09:16:44+00:00

commit 513f61e2193350c7a345da98559b80f61aec4fa6 upstream.

In esp_remove_trailer(), to avoid an unexpected result returned by
pskb_trim, we should check the return value of pskb_trim().

Signed-off-by: Ma Ke 
Signed-off-by: Steffen Klassert 
Signed-off-by: Greg Kroah-Hartman

esp: limit skb_page_frag_refill use to a single page

2022-07-12T14:29:00+00:00

commit 5bd8baab087dff657e05387aee802e70304cc813 upstream.

Commit ebe48d368e97 ("esp: Fix possible buffer overflow in ESP
transformation") tried to fix skb_page_frag_refill usage in ESP by
capping allocsize to 32k, but that doesn't completely solve the issue,
as skb_page_frag_refill may return a single page. If that happens, we
will write out of bounds, despite the check introduced in the previous
patch.

This patch forces COW in cases where we would end up calling
skb_page_frag_refill with a size larger than a page (first in
esp_output_head with tailen, then in esp_output_tail with
skb->data_len).

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Sabrina Dubroca 
Signed-off-by: Steffen Klassert 
Signed-off-by: Greg Kroah-Hartman

esp: Fix possible buffer overflow in ESP transformation

2022-03-28T06:41:42+00:00

commit ebe48d368e97d007bfeb76fcb065d6cfc4c96645 upstream.

The maximum message size that can be send is bigger than
the  maximum site that skb_page_frag_refill can allocate.
So it is possible to write beyond the allocated buffer.

Fix this by doing a fallback to COW in that case.

v2:

Avoid get get_order() costs as suggested by Linus Torvalds.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Reported-by: valis 
Signed-off-by: Steffen Klassert 
Signed-off-by: Vaibhav Rustagi 
Signed-off-by: Greg Kroah-Hartman

esp: avoid unneeded kmap_atomic call

2021-01-23T14:49:55+00:00

[ Upstream commit 9bd6b629c39e3fa9e14243a6d8820492be1a5b2e ]

esp(6)_output_head uses skb_page_frag_refill to allocate a buffer for
the esp trailer.

It accesses the page with kmap_atomic to handle highmem. But
skb_page_frag_refill can return compound pages, of which
kmap_atomic only maps the first underlying page.

skb_page_frag_refill does not return highmem, because flag
__GFP_HIGHMEM is not set. ESP uses it in the same manner as TCP.
That also does not call kmap_atomic, but directly uses page_address,
in skb_copy_to_page_nocache. Do the same for ESP.

This issue has become easier to trigger with recent kmap local
debugging feature CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Willem de Bruijn 
Acked-by: Steffen Klassert 
Signed-off-by: Jakub Kicinski 
Signed-off-by: Greg Kroah-Hartman

esp4: add length check for UDP encapsulation

2019-05-25T16:23:41+00:00

[ Upstream commit 8dfb4eba4100e7cdd161a8baef2d8d61b7a7e62e ]

esp_output_udp_encap can produce a length that doesn't fit in the 16
bits of a UDP header's length field. In that case, we'll send a
fragmented packet whose length is larger than IP_MAX_MTU (resulting in
"Oversized IP packet" warnings on receive) and with a bogus UDP
length.

To prevent this, add a length check to esp_output_udp_encap and return
 -EMSGSIZE on failure.

This seems to be older than git history.

Signed-off-by: Sabrina Dubroca 
Signed-off-by: Steffen Klassert 
Signed-off-by: Sasha Levin

esp: Skip TX bytes accounting when sending from a request socket

2019-03-23T19:09:48+00:00

[ Upstream commit 09db51241118aeb06e1c8cd393b45879ce099b36 ]

On ESP output, sk_wmem_alloc is incremented for the added padding if a
socket is associated to the skb. When replying with TCP SYNACKs over
IPsec, the associated sk is a casted request socket, only. Increasing
sk_wmem_alloc on a request socket results in a write at an arbitrary
struct offset. In the best case, this produces the following WARNING:

WARNING: CPU: 1 PID: 0 at lib/refcount.c:102 esp_output_head+0x2e4/0x308 [esp4]
refcount_t: addition on 0; use-after-free.
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.0.0-rc3 #2
Hardware name: Marvell Armada 380/385 (Device Tree)
[...]
[] (esp_output_head [esp4]) from [] (esp_output+0xb8/0x180 [esp4])
[] (esp_output [esp4]) from [] (xfrm_output_resume+0x558/0x664)
[] (xfrm_output_resume) from [] (xfrm4_output+0x44/0xc4)
[] (xfrm4_output) from [] (tcp_v4_send_synack+0xa8/0xe8)
[] (tcp_v4_send_synack) from [] (tcp_conn_request+0x7f4/0x948)
[] (tcp_conn_request) from [] (tcp_rcv_state_process+0x2a0/0xe64)
[] (tcp_rcv_state_process) from [] (tcp_v4_do_rcv+0xf0/0x1f4)
[] (tcp_v4_do_rcv) from [] (tcp_v4_rcv+0xdb8/0xe20)
[] (tcp_v4_rcv) from [] (ip_protocol_deliver_rcu+0x2c/0x2dc)
[] (ip_protocol_deliver_rcu) from [] (ip_local_deliver_finish+0x48/0x54)
[] (ip_local_deliver_finish) from [] (ip_local_deliver+0x54/0xec)
[] (ip_local_deliver) from [] (ip_rcv+0x48/0xb8)
[] (ip_rcv) from [] (__netif_receive_skb_one_core+0x50/0x6c)
[...]

The issue triggers only when not using TCP syncookies, as for syncookies
no socket is associated.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Signed-off-by: Martin Willi 
Signed-off-by: Steffen Klassert 
Signed-off-by: Sasha Levin

esp4: remove redundant initialization of pointer esph

2018-02-13T12:59:03+00:00

Pointer esph is being assigned a value that is never read, esph is
re-assigned and only read inside an if statement, hence the
initialization is redundant and can be removed.

Cleans up clang warning:
net/ipv4/esp4.c:657:21: warning: Value stored to 'esph' during
its initialization is never read

Signed-off-by: Colin Ian King 
Signed-off-by: Steffen Klassert

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-01-17T05:10:42+00:00

Overlapping changes all over.

The mini-qdisc bits were a little bit tricky, however.

Signed-off-by: David S. Miller

xfrm: Return error on unknown encap_type in init_state

2018-01-08T06:17:52+00:00

Currently esp will happily create an xfrm state with an unknown
encap type for IPv4, without setting the necessary state parameters.
This patch fixes it by returning -EINVAL.

There is a similar problem in IPv6 where if the mode is unknown
we will skip initialisation while returning zero.  However, this
is harmless as the mode has already been checked further up the
stack.  This patch removes this anomaly by aligning the IPv6
behaviour with IPv4 and treating unknown modes (which cannot
actually happen) as transport mode.

Fixes: 38320c70d282 ("[IPSEC]: Use crypto_aead and authenc in ESP")
Signed-off-by: Herbert Xu 
Signed-off-by: Steffen Klassert

esp: Don't require synchronous crypto fallback on offloading anymore.

2017-12-20T09:41:53+00:00

We support asynchronous crypto on layer 2 ESP now.
So no need to force synchronous crypto fallback on
offloading anymore.

Signed-off-by: Steffen Klassert