[PATCH net] xfrm: esp: restore combined single-frag length gate

[Jingguo Tan]

The ESP out-of-place fast path still consumes the combined post-trailer
skb->data_len as a single destination frag in esp_output_tail()/
esp6_output_tail(). The head-side gate must therefore reject any case
where ALIGN(skb->data_len + tailen, L1_CACHE_BYTES) exceeds PAGE_SIZE,
otherwise skb_page_frag_refill() may fall back to a single page and the
destination sg will overrun it.

Restore a combined-length page gate before entering the page-frag fast
path for both IPv4 and IPv6.

Fixes: 5bd8baab087d ("esp: limit skb_page_frag_refill use to a single page"=
)
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Lin Ma <malin89@xxxxxxxxxx>
Signed-off-by: Chenyuan Mi <michenyuan@xxxxxxxxxx>
Signed-off-by: Jingguo Tan <tanjingguo@xxxxxxxxxx>
---

 net/ipv4/esp4.c | 5 +++--
 net/ipv6/esp6.c | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 6a5febbdbee49..2d7daca8516c2 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -410,6 +410,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buf=
f *skb, struct esp_info *
 	struct page *page;
 	struct sk_buff *trailer;
 	int tailen =3D esp->tailen;
+	unsigned int allocsize;
=20
 	/* this is non-NULL only with TCP/UDP Encapsulation */
 	if (x->encap) {
@@ -419,8 +420,8 @@ int esp_output_head(struct xfrm_state *x, struct sk_buf=
f *skb, struct esp_info *
 			return err;
 	}
=20
-	if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE ||
-	    ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE)
+	allocsize =3D ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
+	if (allocsize > PAGE_SIZE)
 		goto cow;
=20
 	if (!skb_cloned(skb)) {
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 9c06c5a1419dc..0fad1dc558b84 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -440,6 +440,7 @@ int esp6_output_head(struct xfrm_state *x, struct sk_bu=
ff *skb, struct esp_info
 	struct page *page;
 	struct sk_buff *trailer;
 	int tailen =3D esp->tailen;
+	unsigned int allocsize;
=20
 	if (x->encap) {
 		int err =3D esp6_output_encap(x, skb, esp);
@@ -448,8 +449,8 @@ int esp6_output_head(struct xfrm_state *x, struct sk_bu=
ff *skb, struct esp_info
 			return err;
 	}
=20
-	if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE ||
-	    ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE)
+	allocsize =3D ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
+	if (allocsize > PAGE_SIZE)
 		goto cow;
=20
 	if (!skb_cloned(skb)) {
--=20
2.43.0