Commit ec3d837a authored by Stanislav Fomichev's avatar Stanislav Fomichev Committed by Alexei Starovoitov

net/flow_dissector: correctly cap nhoff and thoff in case of BPF

We want to make sure that the following condition holds:
0 <= nhoff <= thoff <= skb->len

BPF program can set out-of-bounds nhoff and thoff, which is dangerous, see
recent commit d0c081b4 ("flow_dissector: properly cap thoff field")'.
Signed-off-by: default avatarStanislav Fomichev <sdf@google.com>
Acked-by: default avatarSong Liu <songliubraving@fb.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 13e56ec2
...@@ -791,9 +791,12 @@ bool __skb_flow_dissect(const struct sk_buff *skb, ...@@ -791,9 +791,12 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
/* Restore state */ /* Restore state */
memcpy(cb, &cb_saved, sizeof(cb_saved)); memcpy(cb, &cb_saved, sizeof(cb_saved));
flow_keys.nhoff = clamp_t(u16, flow_keys.nhoff, 0, skb->len);
flow_keys.thoff = clamp_t(u16, flow_keys.thoff,
flow_keys.nhoff, skb->len);
__skb_flow_bpf_to_target(&flow_keys, flow_dissector, __skb_flow_bpf_to_target(&flow_keys, flow_dissector,
target_container); target_container);
key_control->thoff = min_t(u16, key_control->thoff, skb->len);
rcu_read_unlock(); rcu_read_unlock();
return result == BPF_OK; return result == BPF_OK;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment