ipsec: check return value of skb_to_sgvec always

commit 3f29770723fe498a5c5f57c3a31a996ebdde03e1 upstream.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
[nc: Adjust context due to lack of 000ae7b2690e2 and fca11ebde3f0]
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 0157f09c0de97098a689629726690a83a4c6eb7d..00de0e81eb64019d66e41063509d03b2cd10b249 100644 (file)
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -220,7 +220,9 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
        ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
 
        sg_init_table(sg, nfrags + sglists);
-       skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out_free;
 
        if (x->props.flags & XFRM_STATE_ESN) {
                /* Attach seqhi sg right after packet payload */
@@ -391,7 +393,9 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
        skb_push(skb, ihl);
 
        sg_init_table(sg, nfrags + sglists);
-       skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out_free;
 
        if (x->props.flags & XFRM_STATE_ESN) {
                /* Attach seqhi sg right after packet payload */

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 360b565918c4b524d561a010ed7ec5df02312cdb..1ccd3466f89aa7175f55eaebb8367011034badb0 100644 (file)
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -239,9 +239,11 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
        esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
 
        sg_init_table(sg, nfrags);
-       skb_to_sgvec(skb, sg,
-                    esph->enc_data + crypto_aead_ivsize(aead) - skb->data,
-                    clen + alen);
+       err = skb_to_sgvec(skb, sg,
+                          esph->enc_data + crypto_aead_ivsize(aead) - skb->data,
+                          clen + alen);
+       if (unlikely(err < 0))
+               goto error;
 
        if ((x->props.flags & XFRM_STATE_ESN)) {
                sg_init_table(asg, 3);
@@ -426,7 +428,9 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
        iv = esph->enc_data;
 
        sg_init_table(sg, nfrags);
-       skb_to_sgvec(skb, sg, sizeof(*esph) + crypto_aead_ivsize(aead), elen);
+       err = skb_to_sgvec(skb, sg, sizeof(*esph) + crypto_aead_ivsize(aead), elen);
+       if (unlikely(err < 0))
+               goto out;
 
        if ((x->props.flags & XFRM_STATE_ESN)) {
                sg_init_table(asg, 3);

diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 6d16eb0e0c7f938822de68bd57674665dcdcbddf..a472dbd3344b3f8c08068bf0b00f44a31431fecd 100644 (file)
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -423,7 +423,9 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
        ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
 
        sg_init_table(sg, nfrags + sglists);
-       skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out_free;
 
        if (x->props.flags & XFRM_STATE_ESN) {
                /* Attach seqhi sg right after packet payload */
@@ -601,7 +603,9 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
        ip6h->hop_limit   = 0;
 
        sg_init_table(sg, nfrags + sglists);
-       skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out_free;
 
        if (x->props.flags & XFRM_STATE_ESN) {
                /* Attach seqhi sg right after packet payload */

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 83fc3a385a26782c316914c4f8aafab78fe1a5e2..8871a98845c7911b1a8157f88b71556d5bf3a668 100644 (file)
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -231,9 +231,11 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
        esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
 
        sg_init_table(sg, nfrags);
-       skb_to_sgvec(skb, sg,
-                    esph->enc_data + crypto_aead_ivsize(aead) - skb->data,
-                    clen + alen);
+       err = skb_to_sgvec(skb, sg,
+                          esph->enc_data + crypto_aead_ivsize(aead) - skb->data,
+                          clen + alen);
+       if (unlikely(err < 0))
+               goto error;
 
        if ((x->props.flags & XFRM_STATE_ESN)) {
                sg_init_table(asg, 3);
@@ -381,7 +383,9 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
        iv = esph->enc_data;
 
        sg_init_table(sg, nfrags);
-       skb_to_sgvec(skb, sg, sizeof(*esph) + crypto_aead_ivsize(aead), elen);
+       ret = skb_to_sgvec(skb, sg, sizeof(*esph) + crypto_aead_ivsize(aead), elen);
+       if (unlikely(ret < 0))
+               goto out;
 
        if ((x->props.flags & XFRM_STATE_ESN)) {
                sg_init_table(asg, 3);