__skb_nsg() counts the scatterlist entries for a range of an skb with a copy of the __skb_to_sgvec() walk, including its BUG_ON(len) when the skb runs out before the range does. tls_decrypt_sg() calls it on the same range it then passes to skb_to_sgvec(), so a bad range would BUG() here before it got to skb_to_sgvec()'s error return. __skb_nsg() already returns -EMSGSIZE for a frag_list nested too deep, and tls_decrypt_sg() fails the record on any return below 1. Return -EINVAL for the leftover length too, with a DEBUG_NET_WARN_ON_ONCE() for debug kernels, and say so in the comment above skb_nsg(). Acked-by: Mina Almasry Signed-off-by: Josef Bacik --- net/tls/tls_sw.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 771e02bff519..748ae27f2b88 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -142,12 +142,16 @@ static int __skb_nsg(struct sk_buff *skb, int offset, int len, start = end; } } - BUG_ON(len); + if (unlikely(len)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EINVAL; + } return elt; } /* Return the number of scatterlist elements required to completely map the - * skb, or -EMSGSIZE if the recursion depth is exceeded. + * skb, -EMSGSIZE if the recursion depth is exceeded, or -EINVAL if the skb + * runs out before @len does. */ static int skb_nsg(struct sk_buff *skb, int offset, int len) { -- 2.55.0