AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

bpf: fix bpf_skb_load_bytes_relative pkt length check

Browse Source 
The len > skb_headlen(skb) cannot be used as a maximum upper bound
for the packet length since it does not have any relation to the full
linear packet length when filtering is used from upper layers (e.g.
in case of reuseport BPF programs) as by then skb->data, skb->len
already got mangled through __skb_pull() and others.

Fixes: 4e1ec56cdc ("bpf: add skb_load_bytes_relative helper")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Martin KaFai Lau <kafai@fb.com>
This commit is contained in:
Daniel Borkmann 2018-07-28 00:17:56 +02:00
parent b611da43b6
commit 3eee1f75f2
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
net/core/filter.c
View File

@ -1712,24 +1712,26 @@ static const struct bpf_func_proto bpf_skb_load_bytes_proto = {
BPF_CALL_5(bpf_skb_load_bytes_relative, const struct sk_buff *, skb, BPF_CALL_5(bpf_skb_load_bytes_relative, const struct sk_buff *, skb,
u32, offset, void *, to, u32, len, u32, start_header) u32, offset, void *, to, u32, len, u32, start_header)
{ {
u8 *end = skb_tail_pointer(skb);
u8 *net = skb_network_header(skb);
u8 *mac = skb_mac_header(skb);
u8 *ptr; u8 *ptr;
if (unlikely(offset > 0xffff || len > skb_headlen(skb))) if (unlikely(offset > 0xffff || len > (end - mac)))
goto err_clear; goto err_clear;
switch (start_header) { switch (start_header) {
case BPF_HDR_START_MAC: case BPF_HDR_START_MAC:
ptr = skb_mac_header(skb) + offset; ptr = mac + offset;
break; break;
case BPF_HDR_START_NET: case BPF_HDR_START_NET:
ptr = skb_network_header(skb) + offset; ptr = net + offset;
break; break;
default: default:
goto err_clear; goto err_clear;
} }
if (likely(ptr >= skb_mac_header(skb) && if (likely(ptr >= mac && ptr + len <= end)) {
ptr + len <= skb_tail_pointer(skb))) {
memcpy(to, ptr, len); memcpy(to, ptr, len);
return 0; return 0;
} }