diff options
author | Jussi Maki <joamaki@gmail.com> | 2021-11-03 13:47:36 -0700 |
---|---|---|
committer | Daniel Borkmann <daniel@iogearbox.net> | 2021-11-09 01:05:34 +0100 |
commit | b2c4618162ec615a15883a804cce7e27afecfa58 (patch) | |
tree | b0c5f7731a3181f229bba8d6b93980e209bd2abc /include/sound | |
parent | e0dc3b93bd7bcff8c3813d1df43e0908499c7cf0 (diff) | |
download | linux-stable-b2c4618162ec615a15883a804cce7e27afecfa58.tar.gz linux-stable-b2c4618162ec615a15883a804cce7e27afecfa58.tar.bz2 linux-stable-b2c4618162ec615a15883a804cce7e27afecfa58.zip |
bpf, sockmap: sk_skb data_end access incorrect when src_reg = dst_reg
The current conversion of skb->data_end reads like this:
; data_end = (void*)(long)skb->data_end;
559: (79) r1 = *(u64 *)(r2 +200) ; r1 = skb->data
560: (61) r11 = *(u32 *)(r2 +112) ; r11 = skb->len
561: (0f) r1 += r11
562: (61) r11 = *(u32 *)(r2 +116)
563: (1f) r1 -= r11
But similar to the case in 84f44df664e9 ("bpf: sock_ops sk access may stomp
registers when dst_reg = src_reg"), the code will read an incorrect skb->len
when src == dst. In this case we end up generating this xlated code:
; data_end = (void*)(long)skb->data_end;
559: (79) r1 = *(u64 *)(r1 +200) ; r1 = skb->data
560: (61) r11 = *(u32 *)(r1 +112) ; r11 = (skb->data)->len
561: (0f) r1 += r11
562: (61) r11 = *(u32 *)(r1 +116)
563: (1f) r1 -= r11
... where line 560 is the reading 4B of (skb->data + 112) instead of the
intended skb->len Here the skb pointer in r1 gets set to skb->data and the
later deref for skb->len ends up following skb->data instead of skb.
This fixes the issue similarly to the patch mentioned above by creating an
additional temporary variable and using to store the register when dst_reg =
src_reg. We name the variable bpf_temp_reg and place it in the cb context for
sk_skb. Then we restore from the temp to ensure nothing is lost.
Fixes: 16137b09a66f2 ("bpf: Compute data_end dynamically with JIT code")
Signed-off-by: Jussi Maki <joamaki@gmail.com>
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://lore.kernel.org/bpf/20211103204736.248403-6-john.fastabend@gmail.com
Diffstat (limited to 'include/sound')
0 files changed, 0 insertions, 0 deletions