ipsec: check return value of skb_to_sgvec always

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 22377c8ff14b72292caa5c2f72898fc60dcfa576..e8f8623585189943defc832f7f4a0851938334a4 100644 (file)
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -220,7 +220,9 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
        ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
 
        sg_init_table(sg, nfrags + sglists);
-       skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out_free;
 
        if (x->props.flags & XFRM_STATE_ESN) {
                /* Attach seqhi sg right after packet payload */
@@ -393,7 +395,9 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
        skb_push(skb, ihl);
 
        sg_init_table(sg, nfrags + sglists);
-       skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out_free;
 
        if (x->props.flags & XFRM_STATE_ESN) {
                /* Attach seqhi sg right after packet payload */

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 93322f895eab6136adbe22aa37a4eedc9687a0e4..d815d1755473a114deaef19096e2a0ab77a72cf0 100644 (file)
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -377,9 +377,11 @@ int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
        esp->esph = esph;
 
        sg_init_table(sg, esp->nfrags);
-       skb_to_sgvec(skb, sg,
-                    (unsigned char *)esph - skb->data,
-                    assoclen + ivlen + esp->clen + alen);
+       err = skb_to_sgvec(skb, sg,
+                          (unsigned char *)esph - skb->data,
+                          assoclen + ivlen + esp->clen + alen);
+       if (unlikely(err < 0))
+               goto error;
 
        if (!esp->inplace) {
                int allocsize;
@@ -403,9 +405,11 @@ int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
                spin_unlock_bh(&x->lock);
 
                sg_init_table(dsg, skb_shinfo(skb)->nr_frags + 1);
-               skb_to_sgvec(skb, dsg,
-                            (unsigned char *)esph - skb->data,
-                            assoclen + ivlen + esp->clen + alen);
+               err = skb_to_sgvec(skb, dsg,
+                                  (unsigned char *)esph - skb->data,
+                                  assoclen + ivlen + esp->clen + alen);
+               if (unlikely(err < 0))
+                       goto error;
        }
 
        if ((x->props.flags & XFRM_STATE_ESN))
@@ -690,7 +694,9 @@ skip_cow:
        esp_input_set_header(skb, seqhi);
 
        sg_init_table(sg, nfrags);
-       skb_to_sgvec(skb, sg, 0, skb->len);
+       err = skb_to_sgvec(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out;
 
        skb->ip_summed = CHECKSUM_NONE;
 

diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index dda6035e3b8480d9f2640f99f15f19e54b4f6b02..755f38271dd51eca9783fb42fe8530ab4aa937a0 100644 (file)
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -423,7 +423,9 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
        ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
 
        sg_init_table(sg, nfrags + sglists);
-       skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out_free;
 
        if (x->props.flags & XFRM_STATE_ESN) {
                /* Attach seqhi sg right after packet payload */
@@ -606,7 +608,9 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
        ip6h->hop_limit   = 0;
 
        sg_init_table(sg, nfrags + sglists);
-       skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out_free;
 
        if (x->props.flags & XFRM_STATE_ESN) {
                /* Attach seqhi sg right after packet payload */

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 1fe99ba8066c8de2a5717f0b611a152c94837734..2ede4e459c4ed52ac2db262b82580e030e16435f 100644 (file)
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -346,9 +346,11 @@ int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
        esph = esp_output_set_esn(skb, x, ip_esp_hdr(skb), seqhi);
 
        sg_init_table(sg, esp->nfrags);
-       skb_to_sgvec(skb, sg,
-                    (unsigned char *)esph - skb->data,
-                    assoclen + ivlen + esp->clen + alen);
+       err = skb_to_sgvec(skb, sg,
+                          (unsigned char *)esph - skb->data,
+                          assoclen + ivlen + esp->clen + alen);
+       if (unlikely(err < 0))
+               goto error;
 
        if (!esp->inplace) {
                int allocsize;
@@ -372,9 +374,11 @@ int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
                spin_unlock_bh(&x->lock);
 
                sg_init_table(dsg, skb_shinfo(skb)->nr_frags + 1);
-               skb_to_sgvec(skb, dsg,
-                            (unsigned char *)esph - skb->data,
-                            assoclen + ivlen + esp->clen + alen);
+               err = skb_to_sgvec(skb, dsg,
+                                  (unsigned char *)esph - skb->data,
+                                  assoclen + ivlen + esp->clen + alen);
+               if (unlikely(err < 0))
+                       goto error;
        }
 
        if ((x->props.flags & XFRM_STATE_ESN))
@@ -618,7 +622,9 @@ skip_cow:
        esp_input_set_header(skb, seqhi);
 
        sg_init_table(sg, nfrags);
-       skb_to_sgvec(skb, sg, 0, skb->len);
+       ret = skb_to_sgvec(skb, sg, 0, skb->len);
+       if (unlikely(ret < 0))
+               goto out;
 
        skb->ip_summed = CHECKSUM_NONE;