diff options
| author | Stanislav Fomichev <sdf@google.com> | 2022-11-21 21:03:39 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-01-14 12:15:31 +0300 |
| commit | 0d6ae25da5cbe08109c6dd0b265a5ddc71bce25e (patch) | |
| tree | 7ae0bf413d983df6e0d022eb6b9e322c408cff0a | |
| parent | 9920e87a84ec491f0791c76eb42d2524301989bd (diff) | |
| download | linux-0d6ae25da5cbe08109c6dd0b265a5ddc71bce25e.tar.xz | |
bpf: Move skb->len == 0 checks into __bpf_redirect
[ Upstream commit 114039b342014680911c35bd6b72624180fd669a ]
To avoid potentially breaking existing users.
Both mac/no-mac cases have to be amended; mac_header >= network_header
is not enough (verified with a new test, see next patch).
Fixes: fd1894224407 ("bpf: Don't redirect packets with invalid pkt_len")
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/r/20221121180340.1983627-1-sdf@google.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/bpf/test_run.c | 3 | ||||
| -rw-r--r-- | net/core/filter.c | 7 |
2 files changed, 6 insertions, 4 deletions
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index 717b01ff9b2b..7df14a0e380c 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -442,9 +442,6 @@ static int convert___skb_to_skb(struct sk_buff *skb, struct __sk_buff *__skb) { struct qdisc_skb_cb *cb = (struct qdisc_skb_cb *)skb->cb; - if (!skb->len) - return -EINVAL; - if (!__skb) return 0; diff --git a/net/core/filter.c b/net/core/filter.c index 4c22e6d1da74..ef7e74260afc 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2125,6 +2125,11 @@ static int __bpf_redirect_no_mac(struct sk_buff *skb, struct net_device *dev, { unsigned int mlen = skb_network_offset(skb); + if (unlikely(skb->len <= mlen)) { + kfree_skb(skb); + return -ERANGE; + } + if (mlen) { __skb_pull(skb, mlen); @@ -2146,7 +2151,7 @@ static int __bpf_redirect_common(struct sk_buff *skb, struct net_device *dev, u32 flags) { /* Verify that a link layer header is carried */ - if (unlikely(skb->mac_header >= skb->network_header)) { + if (unlikely(skb->mac_header >= skb->network_header || skb->len == 0)) { kfree_skb(skb); return -ERANGE; } |