summaryrefslogtreecommitdiffstats
path: root/include/sound
diff options
context:
space:
mode:
authorJussi Maki <joamaki@gmail.com>2021-11-03 13:47:36 -0700
committerDaniel Borkmann <daniel@iogearbox.net>2021-11-09 01:05:34 +0100
commitb2c4618162ec615a15883a804cce7e27afecfa58 (patch)
treeb0c5f7731a3181f229bba8d6b93980e209bd2abc /include/sound
parente0dc3b93bd7bcff8c3813d1df43e0908499c7cf0 (diff)
downloadlinux-stable-b2c4618162ec615a15883a804cce7e27afecfa58.tar.gz
linux-stable-b2c4618162ec615a15883a804cce7e27afecfa58.tar.bz2
linux-stable-b2c4618162ec615a15883a804cce7e27afecfa58.zip
bpf, sockmap: sk_skb data_end access incorrect when src_reg = dst_reg
The current conversion of skb->data_end reads like this: ; data_end = (void*)(long)skb->data_end; 559: (79) r1 = *(u64 *)(r2 +200) ; r1 = skb->data 560: (61) r11 = *(u32 *)(r2 +112) ; r11 = skb->len 561: (0f) r1 += r11 562: (61) r11 = *(u32 *)(r2 +116) 563: (1f) r1 -= r11 But similar to the case in 84f44df664e9 ("bpf: sock_ops sk access may stomp registers when dst_reg = src_reg"), the code will read an incorrect skb->len when src == dst. In this case we end up generating this xlated code: ; data_end = (void*)(long)skb->data_end; 559: (79) r1 = *(u64 *)(r1 +200) ; r1 = skb->data 560: (61) r11 = *(u32 *)(r1 +112) ; r11 = (skb->data)->len 561: (0f) r1 += r11 562: (61) r11 = *(u32 *)(r1 +116) 563: (1f) r1 -= r11 ... where line 560 is the reading 4B of (skb->data + 112) instead of the intended skb->len Here the skb pointer in r1 gets set to skb->data and the later deref for skb->len ends up following skb->data instead of skb. This fixes the issue similarly to the patch mentioned above by creating an additional temporary variable and using to store the register when dst_reg = src_reg. We name the variable bpf_temp_reg and place it in the cb context for sk_skb. Then we restore from the temp to ensure nothing is lost. Fixes: 16137b09a66f2 ("bpf: Compute data_end dynamically with JIT code") Signed-off-by: Jussi Maki <joamaki@gmail.com> Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://lore.kernel.org/bpf/20211103204736.248403-6-john.fastabend@gmail.com
Diffstat (limited to 'include/sound')
0 files changed, 0 insertions, 0 deletions