lkml.org 
[lkml]   [2020]   [Jun]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.7 368/477] net/filter: Permit reading NET in load_bytes_relative when MAC not set
    Date
    From: YiFei Zhu <zhuyifei1999@gmail.com>

    [ Upstream commit 0f5d82f187e1beda3fe7295dfc500af266a5bd80 ]

    Added a check in the switch case on start_header that checks for
    the existence of the header, and in the case that MAC is not set
    and the caller requests for MAC, -EFAULT. If the caller requests
    for NET then MAC's existence is completely ignored.

    There is no function to check NET header's existence and as far
    as cgroup_skb/egress is concerned it should always be set.

    Removed for ptr >= the start of header, considering offset is
    bounded unsigned and should always be true. len <= end - mac is
    redundant to ptr + len <= end.

    Fixes: 3eee1f75f2b9 ("bpf: fix bpf_skb_load_bytes_relative pkt length check")
    Signed-off-by: YiFei Zhu <zhuyifei@google.com>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Reviewed-by: Stanislav Fomichev <sdf@google.com>
    Link: https://lore.kernel.org/bpf/76bb820ddb6a95f59a772ecbd8c8a336f646b362.1591812755.git.zhuyifei@google.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/core/filter.c | 16 +++++++++-------
    1 file changed, 9 insertions(+), 7 deletions(-)

    diff --git a/net/core/filter.c b/net/core/filter.c
    index 11b97c31bca58..9512a9772d691 100644
    --- a/net/core/filter.c
    +++ b/net/core/filter.c
    @@ -1766,25 +1766,27 @@ BPF_CALL_5(bpf_skb_load_bytes_relative, const struct sk_buff *, skb,
    u32, offset, void *, to, u32, len, u32, start_header)
    {
    u8 *end = skb_tail_pointer(skb);
    - u8 *net = skb_network_header(skb);
    - u8 *mac = skb_mac_header(skb);
    - u8 *ptr;
    + u8 *start, *ptr;

    - if (unlikely(offset > 0xffff || len > (end - mac)))
    + if (unlikely(offset > 0xffff))
    goto err_clear;

    switch (start_header) {
    case BPF_HDR_START_MAC:
    - ptr = mac + offset;
    + if (unlikely(!skb_mac_header_was_set(skb)))
    + goto err_clear;
    + start = skb_mac_header(skb);
    break;
    case BPF_HDR_START_NET:
    - ptr = net + offset;
    + start = skb_network_header(skb);
    break;
    default:
    goto err_clear;
    }

    - if (likely(ptr >= mac && ptr + len <= end)) {
    + ptr = start + offset;
    +
    + if (likely(ptr + len <= end)) {
    memcpy(to, ptr, len);
    return 0;
    }
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-06-23 23:39    [W:2.562 / U:0.460 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site