drop esp-fix-possible-buffer-overflow-in-esp-transformation.patch from a few queues

diff --git a/queue-4.14/esp-fix-possible-buffer-overflow-in-esp-transformation.patch b/queue-4.14/esp-fix-possible-buffer-overflow-in-esp-transformation.patch
deleted file mode 100644 (file)
index 422409b..0000000
--- a/queue-4.14/esp-fix-possible-buffer-overflow-in-esp-transformation.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From ebe48d368e97d007bfeb76fcb065d6cfc4c96645 Mon Sep 17 00:00:00 2001
-From: Steffen Klassert <steffen.klassert@secunet.com>
-Date: Mon, 7 Mar 2022 13:11:39 +0100
-Subject: esp: Fix possible buffer overflow in ESP transformation
-
-From: Steffen Klassert <steffen.klassert@secunet.com>
-
-commit ebe48d368e97d007bfeb76fcb065d6cfc4c96645 upstream.
-
-The maximum message size that can be send is bigger than
-the  maximum site that skb_page_frag_refill can allocate.
-So it is possible to write beyond the allocated buffer.
-
-Fix this by doing a fallback to COW in that case.
-
-v2:
-
-Avoid get get_order() costs as suggested by Linus Torvalds.
-
-Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
-Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
-Reported-by: valis <sec@valis.email>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
-Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/net/esp.h  |    2 ++
- include/net/sock.h |    2 ++
- net/ipv4/esp4.c    |    5 +++++
- net/ipv6/esp6.c    |    5 +++++
- 4 files changed, 14 insertions(+)
-
---- a/include/net/esp.h
-+++ b/include/net/esp.h
-@@ -4,6 +4,8 @@
- 
- #include <linux/skbuff.h>
- 
-+#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER)
-+
- struct ip_esp_hdr;
- 
- static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb)
---- a/include/net/sock.h
-+++ b/include/net/sock.h
-@@ -2438,4 +2438,6 @@ extern int sysctl_optmem_max;
- extern __u32 sysctl_wmem_default;
- extern __u32 sysctl_rmem_default;
- 
-+#define SKB_FRAG_PAGE_ORDER   get_order(32768)
-+
- #endif        /* _SOCK_H */
---- a/net/ipv4/esp4.c
-+++ b/net/ipv4/esp4.c
-@@ -257,6 +257,7 @@ int esp_output_head(struct xfrm_state *x
-       struct page *page;
-       struct sk_buff *trailer;
-       int tailen = esp->tailen;
-+      unsigned int allocsz;
- 
-       /* this is non-NULL only with UDP Encapsulation */
-       if (x->encap) {
-@@ -266,6 +267,10 @@ int esp_output_head(struct xfrm_state *x
-                       return err;
-       }
- 
-+      allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
-+      if (allocsz > ESP_SKB_FRAG_MAXSIZE)
-+              goto cow;
-+
-       if (!skb_cloned(skb)) {
-               if (tailen <= skb_tailroom(skb)) {
-                       nfrags = 1;
---- a/net/ipv6/esp6.c
-+++ b/net/ipv6/esp6.c
-@@ -223,6 +223,7 @@ int esp6_output_head(struct xfrm_state *
-       struct page *page;
-       struct sk_buff *trailer;
-       int tailen = esp->tailen;
-+      unsigned int allocsz;
- 
-       if (!skb_cloned(skb)) {
-               if (tailen <= skb_tailroom(skb)) {
-@@ -611,6 +612,10 @@ static int esp6_input(struct xfrm_state
-               assoclen += seqhilen;
-       }
- 
-+      allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
-+      if (allocsz > ESP_SKB_FRAG_MAXSIZE)
-+              goto cow;
-+
-       if (!skb_cloned(skb)) {
-               if (!skb_is_nonlinear(skb)) {
-                       nfrags = 1;

diff --git a/queue-4.14/series b/queue-4.14/series
index c262bf811e2c1d473a3a31f78b5bcd21a253b39b..531d8901ba3614579fbee13c6a6ea71a191fbefc 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -20,4 +20,3 @@ usb-gadget-rndis-prevent-integer-overflow-in-rndis_set_response.patch
 usb-gadget-fix-use-after-free-bug-by-not-setting-udc-dev.driver.patch
 input-aiptek-properly-check-endpoint-type.patch
 perf-symbols-fix-symbol-size-calculation-condition.patch
-esp-fix-possible-buffer-overflow-in-esp-transformation.patch

diff --git a/queue-4.19/esp-fix-possible-buffer-overflow-in-esp-transformation.patch b/queue-4.19/esp-fix-possible-buffer-overflow-in-esp-transformation.patch
deleted file mode 100644 (file)
index 71ab82e..0000000
--- a/queue-4.19/esp-fix-possible-buffer-overflow-in-esp-transformation.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From ebe48d368e97d007bfeb76fcb065d6cfc4c96645 Mon Sep 17 00:00:00 2001
-From: Steffen Klassert <steffen.klassert@secunet.com>
-Date: Mon, 7 Mar 2022 13:11:39 +0100
-Subject: esp: Fix possible buffer overflow in ESP transformation
-
-From: Steffen Klassert <steffen.klassert@secunet.com>
-
-commit ebe48d368e97d007bfeb76fcb065d6cfc4c96645 upstream.
-
-The maximum message size that can be send is bigger than
-the  maximum site that skb_page_frag_refill can allocate.
-So it is possible to write beyond the allocated buffer.
-
-Fix this by doing a fallback to COW in that case.
-
-v2:
-
-Avoid get get_order() costs as suggested by Linus Torvalds.
-
-Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
-Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
-Reported-by: valis <sec@valis.email>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
-Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/net/esp.h  |    2 ++
- include/net/sock.h |    2 ++
- net/ipv4/esp4.c    |    5 +++++
- net/ipv6/esp6.c    |    5 +++++
- 4 files changed, 14 insertions(+)
-
---- a/include/net/esp.h
-+++ b/include/net/esp.h
-@@ -4,6 +4,8 @@
- 
- #include <linux/skbuff.h>
- 
-+#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER)
-+
- struct ip_esp_hdr;
- 
- static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb)
---- a/include/net/sock.h
-+++ b/include/net/sock.h
-@@ -2518,6 +2518,8 @@ extern int sysctl_optmem_max;
- extern __u32 sysctl_wmem_default;
- extern __u32 sysctl_rmem_default;
- 
-+#define SKB_FRAG_PAGE_ORDER   get_order(32768)
-+
- static inline int sk_get_wmem0(const struct sock *sk, const struct proto *proto)
- {
-       /* Does this proto have per netns sysctl_wmem ? */
---- a/net/ipv4/esp4.c
-+++ b/net/ipv4/esp4.c
-@@ -275,6 +275,7 @@ int esp_output_head(struct xfrm_state *x
-       struct page *page;
-       struct sk_buff *trailer;
-       int tailen = esp->tailen;
-+      unsigned int allocsz;
- 
-       /* this is non-NULL only with UDP Encapsulation */
-       if (x->encap) {
-@@ -284,6 +285,10 @@ int esp_output_head(struct xfrm_state *x
-                       return err;
-       }
- 
-+      allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
-+      if (allocsz > ESP_SKB_FRAG_MAXSIZE)
-+              goto cow;
-+
-       if (!skb_cloned(skb)) {
-               if (tailen <= skb_tailroom(skb)) {
-                       nfrags = 1;
---- a/net/ipv6/esp6.c
-+++ b/net/ipv6/esp6.c
-@@ -241,6 +241,7 @@ int esp6_output_head(struct xfrm_state *
-       struct page *page;
-       struct sk_buff *trailer;
-       int tailen = esp->tailen;
-+      unsigned int allocsz;
- 
-       if (!skb_cloned(skb)) {
-               if (tailen <= skb_tailroom(skb)) {
-@@ -629,6 +630,10 @@ static int esp6_input(struct xfrm_state
-               assoclen += seqhilen;
-       }
- 
-+      allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
-+      if (allocsz > ESP_SKB_FRAG_MAXSIZE)
-+              goto cow;
-+
-       if (!skb_cloned(skb)) {
-               if (!skb_is_nonlinear(skb)) {
-                       nfrags = 1;

diff --git a/queue-4.19/series b/queue-4.19/series
index 597cf2677ee3ea383eee702a22be9bc7041973b9..2c4a840dd061e0cfcdeb5ceaeab83742b569ca18 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -55,4 +55,3 @@ usb-gadget-rndis-prevent-integer-overflow-in-rndis_set_response.patch
 usb-gadget-fix-use-after-free-bug-by-not-setting-udc-dev.driver.patch
 input-aiptek-properly-check-endpoint-type.patch
 perf-symbols-fix-symbol-size-calculation-condition.patch
-esp-fix-possible-buffer-overflow-in-esp-transformation.patch

diff --git a/queue-5.4/esp-fix-possible-buffer-overflow-in-esp-transformation.patch b/queue-5.4/esp-fix-possible-buffer-overflow-in-esp-transformation.patch
deleted file mode 100644 (file)
index 7ddfe59..0000000
--- a/queue-5.4/esp-fix-possible-buffer-overflow-in-esp-transformation.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From ebe48d368e97d007bfeb76fcb065d6cfc4c96645 Mon Sep 17 00:00:00 2001
-From: Steffen Klassert <steffen.klassert@secunet.com>
-Date: Mon, 7 Mar 2022 13:11:39 +0100
-Subject: esp: Fix possible buffer overflow in ESP transformation
-
-From: Steffen Klassert <steffen.klassert@secunet.com>
-
-commit ebe48d368e97d007bfeb76fcb065d6cfc4c96645 upstream.
-
-The maximum message size that can be send is bigger than
-the  maximum site that skb_page_frag_refill can allocate.
-So it is possible to write beyond the allocated buffer.
-
-Fix this by doing a fallback to COW in that case.
-
-v2:
-
-Avoid get get_order() costs as suggested by Linus Torvalds.
-
-Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
-Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
-Reported-by: valis <sec@valis.email>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
-Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/net/esp.h  |    2 ++
- include/net/sock.h |    1 +
- net/ipv4/esp4.c    |    5 +++++
- net/ipv6/esp6.c    |    5 +++++
- 4 files changed, 13 insertions(+)
-
---- a/include/net/esp.h
-+++ b/include/net/esp.h
-@@ -4,6 +4,8 @@
- 
- #include <linux/skbuff.h>
- 
-+#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER)
-+
- struct ip_esp_hdr;
- 
- static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb)
---- a/include/net/sock.h
-+++ b/include/net/sock.h
-@@ -2583,6 +2583,7 @@ extern int sysctl_optmem_max;
- extern __u32 sysctl_wmem_default;
- extern __u32 sysctl_rmem_default;
- 
-+#define SKB_FRAG_PAGE_ORDER   get_order(32768)
- DECLARE_STATIC_KEY_FALSE(net_high_order_alloc_disable_key);
- 
- static inline int sk_get_wmem0(const struct sock *sk, const struct proto *proto)
---- a/net/ipv4/esp4.c
-+++ b/net/ipv4/esp4.c
-@@ -277,6 +277,7 @@ int esp_output_head(struct xfrm_state *x
-       struct page *page;
-       struct sk_buff *trailer;
-       int tailen = esp->tailen;
-+      unsigned int allocsz;
- 
-       /* this is non-NULL only with UDP Encapsulation */
-       if (x->encap) {
-@@ -286,6 +287,10 @@ int esp_output_head(struct xfrm_state *x
-                       return err;
-       }
- 
-+      allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
-+      if (allocsz > ESP_SKB_FRAG_MAXSIZE)
-+              goto cow;
-+
-       if (!skb_cloned(skb)) {
-               if (tailen <= skb_tailroom(skb)) {
-                       nfrags = 1;
---- a/net/ipv6/esp6.c
-+++ b/net/ipv6/esp6.c
-@@ -230,6 +230,7 @@ int esp6_output_head(struct xfrm_state *
-       struct page *page;
-       struct sk_buff *trailer;
-       int tailen = esp->tailen;
-+      unsigned int allocsz;
- 
-       if (!skb_cloned(skb)) {
-               if (tailen <= skb_tailroom(skb)) {
-@@ -617,6 +618,10 @@ static int esp6_input(struct xfrm_state
-               assoclen += seqhilen;
-       }
- 
-+      allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
-+      if (allocsz > ESP_SKB_FRAG_MAXSIZE)
-+              goto cow;
-+
-       if (!skb_cloned(skb)) {
-               if (!skb_is_nonlinear(skb)) {
-                       nfrags = 1;

diff --git a/queue-5.4/series b/queue-5.4/series
index e611087354192b2c3188c11e57ffc16b5d69cde8..879fcab6b6a79c2fc544d8676a92a194b09d27ea 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -14,5 +14,4 @@ usb-gadget-fix-use-after-free-bug-by-not-setting-udc-dev.driver.patch
 usb-usbtmc-fix-bug-in-pipe-direction-for-control-transfers.patch
 input-aiptek-properly-check-endpoint-type.patch
 perf-symbols-fix-symbol-size-calculation-condition.patch
-esp-fix-possible-buffer-overflow-in-esp-transformation.patch
 revert-selftests-bpf-add-test-for-bpf_timer-overwriting-crash.patch