p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

net/tls: fix copy to fragments in reencrypt 

Fragments may contain data from other records so we have to account
for that when we calculate the destination and max length of copy we
can perform.  Note that 'offset' is the offset within the message,
so it can't be passed as offset within the frag..

Here skb_store_bits() would have realised the call is wrong and
simply not copy data.

Fixes: 4799ac81e5 ("tls: Add rx inline crypto offload")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: John Hurley <john.hurley@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jakub Kicinski 2019-04-25 17:35:10 -07:00 committed by David S. Miller
parent 97e1caa517
commit eb3d38d5ad
1 changed files with 22 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
net/tls/tls_device.c
View File

@ -597,7 +597,7 @@ void handle_device_resync(struct sock *sk, u32 seq, u64 rcd_sn)
static int tls_device_reencrypt(struct sock *sk, struct sk_buff *skb) static int tls_device_reencrypt(struct sock *sk, struct sk_buff *skb)
{ {
struct strp_msg *rxm = strp_msg(skb); struct strp_msg *rxm = strp_msg(skb);
int err = 0, offset = rxm->offset, copy, nsg; int err = 0, offset = rxm->offset, copy, nsg, data_len, pos;
struct sk_buff *skb_iter, *unused; struct sk_buff *skb_iter, *unused;
struct scatterlist sg[1]; struct scatterlist sg[1];
char *orig_buf, *buf; char *orig_buf, *buf;
@ -628,9 +628,10 @@ static int tls_device_reencrypt(struct sock *sk, struct sk_buff *skb)
else else
err = 0; err = 0;
data_len = rxm->full_len - TLS_CIPHER_AES_GCM_128_TAG_SIZE;
if (skb_pagelen(skb) > offset) { if (skb_pagelen(skb) > offset) {
copy = min_t(int, skb_pagelen(skb) - offset, copy = min_t(int, skb_pagelen(skb) - offset, data_len);
rxm->full_len - TLS_CIPHER_AES_GCM_128_TAG_SIZE);
if (skb->decrypted) if (skb->decrypted)
skb_store_bits(skb, offset, buf, copy); skb_store_bits(skb, offset, buf, copy);
@ -639,16 +640,30 @@ static int tls_device_reencrypt(struct sock *sk, struct sk_buff *skb)
buf += copy; buf += copy;
} }
pos = skb_pagelen(skb);
skb_walk_frags(skb, skb_iter) { skb_walk_frags(skb, skb_iter) {
copy = min_t(int, skb_iter->len, int frag_pos;
rxm->full_len - offset + rxm->offset -
TLS_CIPHER_AES_GCM_128_TAG_SIZE); /* Practically all frags must belong to msg if reencrypt
* is needed with current strparser and coalescing logic,
* but strparser may "get optimized", so let's be safe.
*/
if (pos + skb_iter->len <= offset)
goto done_with_frag;
if (pos >= data_len + rxm->offset)
break;
frag_pos = offset - pos;
copy = min_t(int, skb_iter->len - frag_pos,
data_len + rxm->offset - offset);
if (skb_iter->decrypted) if (skb_iter->decrypted)
skb_store_bits(skb_iter, offset, buf, copy); skb_store_bits(skb_iter, frag_pos, buf, copy);
offset += copy; offset += copy;
buf += copy; buf += copy;
done_with_frag:
pos += skb_iter->len;
} }
free_buf: free_buf: