Received: by 2002:a05:6a10:c7c6:0:0:0:0 with SMTP id h6csp1659784pxy; Mon, 2 Aug 2021 07:16:27 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwdsYgNVmifL7pYsVLC9xngo+rccID2gsbX8GTFxuATkM9sRmG4bFHHua3C72NNFYLgFZng X-Received: by 2002:a50:ed14:: with SMTP id j20mr19129580eds.323.1627913787564; Mon, 02 Aug 2021 07:16:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1627913787; cv=none; d=google.com; s=arc-20160816; b=tgoOF2bA9FbADZzx+m5RjYFcm6UyDviHlnEg42YLztZcdswmc53dvi/gfWh/2CgTuQ kdW5GCPcDNssNug6wykPYRLOoqbVVFazeYP8naXWOcnxLd0h/LXpkYgWx/L4K/uvCWQ8 71qiodp9Ty67bqdvU5Q1YP/ERq18AkcHC+NqbRk1xfxtbQxhWJSPb6e7eyJA5qV55XKi fo6Fb8tXbUp+paNk+Vw5i91ugEuiahVXCRlGoT4dFniR8d/HVl7069nz8puJ/OxTTLYo f50lgwWwBOByKkwmFt1HtrQ4maut5/dDITYdr3hfQ6Ap9b92oivzJjlXduuSrjWrOKWx pHZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=QoZ6JG4gtM/tP494XuSNozksYqHXrkgef2ytSCZARug=; b=VKHR5QA3GKI0mvlumPcKIIwUqwtzAYG6uZmfLEi1hfiOrAhwpP/sf5nj9MYyYp3lLI ovM+wKkrQr3Wirce47zUHvwqSRx0Fdt1WCsX5IYuP1Nd53Vy+WKO2QBBvE7gw4xaFoGH pykhm8hbgHYdMIM1idylcD3LKtwooOaj9pAPFCdmTvTum+6ofUuTs5xsi6xmgXCQ3nSV JACwvtMAFz3i1scXRWEt/XG6FQcEKFemQB6kS4u0/xzfjDzoEI0VPMdB+7j7wZAemqvs Qe3SKYSTuuUybI+9GbklWavdeoUUaYxd6K4nlbBhKYdjK5PUHCW0VBPUO7iQn789MZ7U AuuA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=nY7+7kgG; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id bh4si12308574ejb.56.2021.08.02.07.16.03; Mon, 02 Aug 2021 07:16:27 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=nY7+7kgG; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237907AbhHBOKQ (ORCPT + 99 others); Mon, 2 Aug 2021 10:10:16 -0400 Received: from mail.kernel.org ([198.145.29.99]:48968 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234806AbhHBOBQ (ORCPT ); Mon, 2 Aug 2021 10:01:16 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8779261184; Mon, 2 Aug 2021 13:56:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1627912588; bh=eG0MVS+ns74U2oOzbqDmKfPXvRJohM30sdCjJ9bqqww=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nY7+7kgG5OJ14blnOBMOhmogyGHwQhAyx+jJpp2r6ljBsKLk1fcsvalHXIv8sSP1A wVfuAAQ3IZ4F4Tz+EdnES+uHIWq8eMD3h9Hbc8MTOxKyjkz2fH6U7hd2X8A0et0alk 5L/HuVG2vabUBDc1HAHCoKIv1qADqfEK5UgnCYOI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shuang Li , Xin Long , Jon Maloy , "David S. Miller" , Sasha Levin Subject: [PATCH 5.13 061/104] tipc: do not write skb_shinfo frags when doing decrytion Date: Mon, 2 Aug 2021 15:44:58 +0200 Message-Id: <20210802134346.006568285@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210802134344.028226640@linuxfoundation.org> References: <20210802134344.028226640@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Xin Long [ Upstream commit 3cf4375a090473d240281a0d2b04a3a5aaeac34b ] One skb's skb_shinfo frags are not writable, and they can be shared with other skbs' like by pskb_copy(). To write the frags may cause other skb's data crash. So before doing en/decryption, skb_cow_data() should always be called for a cloned or nonlinear skb if req dst is using the same sg as req src. While at it, the likely branch can be removed, as it will be covered by skb_cow_data(). Note that esp_input() has the same issue, and I will fix it in another patch. tipc_aead_encrypt() doesn't have this issue, as it only processes linear data in the unlikely branch. Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") Reported-by: Shuang Li Signed-off-by: Xin Long Acked-by: Jon Maloy Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- net/tipc/crypto.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c index e5c43d4d5a75..c9391d38de85 100644 --- a/net/tipc/crypto.c +++ b/net/tipc/crypto.c @@ -898,16 +898,10 @@ static int tipc_aead_decrypt(struct net *net, struct tipc_aead *aead, if (unlikely(!aead)) return -ENOKEY; - /* Cow skb data if needed */ - if (likely(!skb_cloned(skb) && - (!skb_is_nonlinear(skb) || !skb_has_frag_list(skb)))) { - nsg = 1 + skb_shinfo(skb)->nr_frags; - } else { - nsg = skb_cow_data(skb, 0, &unused); - if (unlikely(nsg < 0)) { - pr_err("RX: skb_cow_data() returned %d\n", nsg); - return nsg; - } + nsg = skb_cow_data(skb, 0, &unused); + if (unlikely(nsg < 0)) { + pr_err("RX: skb_cow_data() returned %d\n", nsg); + return nsg; } /* Allocate memory for the AEAD operation */ -- 2.30.2