Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-22 20:22:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

tipc: do not write skb_shinfo frags when doing decrytion

Browse Source 
One skb's skb_shinfo frags are not writable, and they can be shared with
other skbs' like by pskb_copy(). To write the frags may cause other skb's
data crash.

So before doing en/decryption, skb_cow_data() should always be called for
a cloned or nonlinear skb if req dst is using the same sg as req src.
While at it, the likely branch can be removed, as it will be covered
by skb_cow_data().

Note that esp_input() has the same issue, and I will fix it in another
patch. tipc_aead_encrypt() doesn't have this issue, as it only processes
linear data in the unlikely branch.

Fixes: fc1b6d6de2 ("tipc: introduce TIPC encryption & authentication")
Reported-by: Shuang Li <shuali@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Xin Long 2021-07-23 18:46:01 -04:00 committed by David S. Miller
parent e394f1e3b1
commit 3cf4375a09
1 changed files with 4 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
net/tipc/crypto.c
View File

@ -898,16 +898,10 @@ static int tipc_aead_decrypt(struct net *net, struct tipc_aead *aead,
if (unlikely(!aead))
return -ENOKEY;
/* Cow skb data if needed */
if (likely(!skb_cloned(skb) &&
(!skb_is_nonlinear(skb) || !skb_has_frag_list(skb)))) {
nsg = 1 + skb_shinfo(skb)->nr_frags;
} else {
nsg = skb_cow_data(skb, 0, &unused);
if (unlikely(nsg < 0)) {
pr_err("RX: skb_cow_data() returned %d\n", nsg);
return nsg;
}
nsg = skb_cow_data(skb, 0, &unused);
if (unlikely(nsg < 0)) {
pr_err("RX: skb_cow_data() returned %d\n", nsg);
return nsg;
}
/* Allocate memory for the AEAD operation */