4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jason A. Donenfeld <ja...@zx2c4.com>

commit 3f29770723fe498a5c5f57c3a31a996ebdde03e1 upstream.

Signed-off-by: Jason A. Donenfeld <ja...@zx2c4.com>
Cc: Steffen Klassert <steffen.klass...@secunet.com>
Cc: Herbert Xu <herb...@gondor.apana.org.au>
Cc: "David S. Miller" <da...@davemloft.net>
Signed-off-by: David S. Miller <da...@davemloft.net>
[natechancellor: Adjusted context due to lack of fca11ebde3f0]
Signed-off-by: Nathan Chancellor <natechancel...@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
 net/ipv4/ah4.c  |    8 ++++++--
 net/ipv4/esp4.c |   13 ++++++++-----
 net/ipv6/ah6.c  |    8 ++++++--
 net/ipv6/esp6.c |   12 ++++++++----
 4 files changed, 28 insertions(+), 13 deletions(-)

--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -220,7 +220,9 @@ static int ah_output(struct xfrm_state *
        ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
 
        sg_init_table(sg, nfrags + sglists);
-       skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out_free;
 
        if (x->props.flags & XFRM_STATE_ESN) {
                /* Attach seqhi sg right after packet payload */
@@ -393,7 +395,9 @@ static int ah_input(struct xfrm_state *x
        skb_push(skb, ihl);
 
        sg_init_table(sg, nfrags + sglists);
-       skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out_free;
 
        if (x->props.flags & XFRM_STATE_ESN) {
                /* Attach seqhi sg right after packet payload */
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -268,10 +268,11 @@ static int esp_output(struct xfrm_state
        esph->spi = x->id.spi;
 
        sg_init_table(sg, nfrags);
-       skb_to_sgvec(skb, sg,
-                    (unsigned char *)esph - skb->data,
-                    assoclen + ivlen + clen + alen);
-
+       err = skb_to_sgvec(skb, sg,
+                          (unsigned char *)esph - skb->data,
+                          assoclen + ivlen + clen + alen);
+       if (unlikely(err < 0))
+               goto error;
        aead_request_set_crypt(req, sg, sg, ivlen + clen, iv);
        aead_request_set_ad(req, assoclen);
 
@@ -481,7 +482,9 @@ static int esp_input(struct xfrm_state *
        }
 
        sg_init_table(sg, nfrags);
-       skb_to_sgvec(skb, sg, 0, skb->len);
+       err = skb_to_sgvec(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out;
 
        aead_request_set_crypt(req, sg, sg, elen + ivlen, iv);
        aead_request_set_ad(req, assoclen);
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -423,7 +423,9 @@ static int ah6_output(struct xfrm_state
        ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
 
        sg_init_table(sg, nfrags + sglists);
-       skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out_free;
 
        if (x->props.flags & XFRM_STATE_ESN) {
                /* Attach seqhi sg right after packet payload */
@@ -603,7 +605,9 @@ static int ah6_input(struct xfrm_state *
        ip6h->hop_limit   = 0;
 
        sg_init_table(sg, nfrags + sglists);
-       skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+       if (unlikely(err < 0))
+               goto out_free;
 
        if (x->props.flags & XFRM_STATE_ESN) {
                /* Attach seqhi sg right after packet payload */
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -248,9 +248,11 @@ static int esp6_output(struct xfrm_state
        esph->spi = x->id.spi;
 
        sg_init_table(sg, nfrags);
-       skb_to_sgvec(skb, sg,
-                    (unsigned char *)esph - skb->data,
-                    assoclen + ivlen + clen + alen);
+       err = skb_to_sgvec(skb, sg,
+                          (unsigned char *)esph - skb->data,
+                          assoclen + ivlen + clen + alen);
+       if (unlikely(err < 0))
+               goto error;
 
        aead_request_set_crypt(req, sg, sg, ivlen + clen, iv);
        aead_request_set_ad(req, assoclen);
@@ -423,7 +425,9 @@ static int esp6_input(struct xfrm_state
        }
 
        sg_init_table(sg, nfrags);
-       skb_to_sgvec(skb, sg, 0, skb->len);
+       ret = skb_to_sgvec(skb, sg, 0, skb->len);
+       if (unlikely(ret < 0))
+               goto out;
 
        aead_request_set_crypt(req, sg, sg, elen + ivlen, iv);
        aead_request_set_ad(req, assoclen);


Reply via email to