Messages in this thread Patch in this message | | | From | Sasha Levin <> | Subject | [PATCH AUTOSEL 4.18 50/76] bpf: Fix bpf_msg_pull_data() | Date | Mon, 24 Sep 2018 14:48:32 +0000 |
| |
From: Tushar Dave <tushar.n.dave@oracle.com>
[ Upstream commit 9db39f4d4f94b61e4b64b077f6ddb2bdfb533a88 ]
Helper bpf_msg_pull_data() mistakenly reuses variable 'offset' while linearizing multiple scatterlist elements. Variable 'offset' is used to find first starting scatterlist element i.e. msg->data = sg_virt(&sg[first_sg]) + start - offset"
Use different variable name while linearizing multiple scatterlist elements so that value contained in variable 'offset' won't get overwritten.
Fixes: 015632bb30da ("bpf: sk_msg program helper bpf_sk_msg_pull_data") Signed-off-by: Tushar Dave <tushar.n.dave@oracle.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> --- net/core/filter.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c index a80b57e4aaed..963ee2e88861 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2282,7 +2282,7 @@ static const struct bpf_func_proto bpf_msg_cork_bytes_proto = { BPF_CALL_4(bpf_msg_pull_data, struct sk_msg_buff *, msg, u32, start, u32, end, u64, flags) { - unsigned int len = 0, offset = 0, copy = 0; + unsigned int len = 0, offset = 0, copy = 0, poffset = 0; int bytes = end - start, bytes_sg_total; struct scatterlist *sg = msg->sg_data; int first_sg, last_sg, i, shift; @@ -2338,16 +2338,15 @@ BPF_CALL_4(bpf_msg_pull_data, if (unlikely(!page)) return -ENOMEM; p = page_address(page); - offset = 0; i = first_sg; do { from = sg_virt(&sg[i]); len = sg[i].length; - to = p + offset; + to = p + poffset; memcpy(to, from, len); - offset += len; + poffset += len; sg[i].length = 0; put_page(sg_page(&sg[i])); -- 2.17.1
| |