Skip to content

Commit

Permalink
ipsec: check return value of skb_to_sgvec always
Browse files Browse the repository at this point in the history 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Jason A. Donenfeld authored and David S. Miller committed Jun 5, 2017
1 parent 48a1df6 commit 3f29770
Show file tree
Hide file tree
Showing 4 changed files with 38 additions and 18 deletions.
8 changes: 6 additions & 2 deletions net/ipv4/ah4.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -220,7 +220,9 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);

sg_init_table(sg, nfrags + sglists);
skb_to_sgvec_nomark(skb, sg, 0, skb->len);
err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
if (unlikely(err < 0))
goto out_free;

if (x->props.flags & XFRM_STATE_ESN) {
/* Attach seqhi sg right after packet payload */
Expand Down Expand Up @@ -393,7 +395,9 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
skb_push(skb, ihl);

sg_init_table(sg, nfrags + sglists);
skb_to_sgvec_nomark(skb, sg, 0, skb->len);
err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
if (unlikely(err < 0))
goto out_free;

if (x->props.flags & XFRM_STATE_ESN) {
/* Attach seqhi sg right after packet payload */
Expand Down
20 changes: 13 additions & 7 deletions net/ipv4/esp4.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -377,9 +377,11 @@ int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
esp->esph = esph;

sg_init_table(sg, esp->nfrags);
skb_to_sgvec(skb, sg,
(unsigned char *)esph - skb->data,
assoclen + ivlen + esp->clen + alen);
err = skb_to_sgvec(skb, sg,
(unsigned char *)esph - skb->data,
assoclen + ivlen + esp->clen + alen);
if (unlikely(err < 0))
goto error;

if (!esp->inplace) {
int allocsize;
Expand All @@ -403,9 +405,11 @@ int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
spin_unlock_bh(&x->lock);

sg_init_table(dsg, skb_shinfo(skb)->nr_frags + 1);
skb_to_sgvec(skb, dsg,
(unsigned char *)esph - skb->data,
assoclen + ivlen + esp->clen + alen);
err = skb_to_sgvec(skb, dsg,
(unsigned char *)esph - skb->data,
assoclen + ivlen + esp->clen + alen);
if (unlikely(err < 0))
goto error;
}

if ((x->props.flags & XFRM_STATE_ESN))
Expand Down Expand Up @@ -690,7 +694,9 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
esp_input_set_header(skb, seqhi);

sg_init_table(sg, nfrags);
skb_to_sgvec(skb, sg, 0, skb->len);
err = skb_to_sgvec(skb, sg, 0, skb->len);
if (unlikely(err < 0))
goto out;

skb->ip_summed = CHECKSUM_NONE;

Expand Down
8 changes: 6 additions & 2 deletions net/ipv6/ah6.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -423,7 +423,9 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);

sg_init_table(sg, nfrags + sglists);
skb_to_sgvec_nomark(skb, sg, 0, skb->len);
err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
if (unlikely(err < 0))
goto out_free;

if (x->props.flags & XFRM_STATE_ESN) {
/* Attach seqhi sg right after packet payload */
Expand Down Expand Up @@ -606,7 +608,9 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
ip6h->hop_limit = 0;

sg_init_table(sg, nfrags + sglists);
skb_to_sgvec_nomark(skb, sg, 0, skb->len);
err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
if (unlikely(err < 0))
goto out_free;

if (x->props.flags & XFRM_STATE_ESN) {
/* Attach seqhi sg right after packet payload */
Expand Down
20 changes: 13 additions & 7 deletions net/ipv6/esp6.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -346,9 +346,11 @@ int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
esph = esp_output_set_esn(skb, x, ip_esp_hdr(skb), seqhi);

sg_init_table(sg, esp->nfrags);
skb_to_sgvec(skb, sg,
(unsigned char *)esph - skb->data,
assoclen + ivlen + esp->clen + alen);
err = skb_to_sgvec(skb, sg,
(unsigned char *)esph - skb->data,
assoclen + ivlen + esp->clen + alen);
if (unlikely(err < 0))
goto error;

if (!esp->inplace) {
int allocsize;
Expand All @@ -372,9 +374,11 @@ int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
spin_unlock_bh(&x->lock);

sg_init_table(dsg, skb_shinfo(skb)->nr_frags + 1);
skb_to_sgvec(skb, dsg,
(unsigned char *)esph - skb->data,
assoclen + ivlen + esp->clen + alen);
err = skb_to_sgvec(skb, dsg,
(unsigned char *)esph - skb->data,
assoclen + ivlen + esp->clen + alen);
if (unlikely(err < 0))
goto error;
}

if ((x->props.flags & XFRM_STATE_ESN))
Expand Down Expand Up @@ -618,7 +622,9 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
esp_input_set_header(skb, seqhi);

sg_init_table(sg, nfrags);
skb_to_sgvec(skb, sg, 0, skb->len);
ret = skb_to_sgvec(skb, sg, 0, skb->len);
if (unlikely(ret < 0))
goto out;

skb->ip_summed = CHECKSUM_NONE;

Expand Down

0 comments on commit 3f29770

Please sign in to comment.