diff options
| author | Stanislav Fomichev <sdf@google.com> | 2022-11-21 10:03:39 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-12-31 13:32:14 +0100 |
| commit | 21f15d8ffdb46e95d721810c2d7ed2149fff397c (patch) | |
| tree | 6904a06708b41c9e5985b00f121839e968aa0a66 /net | |
| parent | 92f30b33df3d5609f7f613f72238e07aabcb36cd (diff) | |
| download | linux-stable-21f15d8ffdb46e95d721810c2d7ed2149fff397c.tar.gz linux-stable-21f15d8ffdb46e95d721810c2d7ed2149fff397c.tar.bz2 linux-stable-21f15d8ffdb46e95d721810c2d7ed2149fff397c.zip | |
bpf: Move skb->len == 0 checks into __bpf_redirect
[ Upstream commit 114039b342014680911c35bd6b72624180fd669a ]
To avoid potentially breaking existing users.
Both mac/no-mac cases have to be amended; mac_header >= network_header
is not enough (verified with a new test, see next patch).
Fixes: fd1894224407 ("bpf: Don't redirect packets with invalid pkt_len")
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/r/20221121180340.1983627-1-sdf@google.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bpf/test_run.c | 3 | ||||
| -rw-r--r-- | net/core/filter.c | 7 |
2 files changed, 6 insertions, 4 deletions
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index fcb3e6c5e03c..6094ef7cffcd 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -980,9 +980,6 @@ static int convert___skb_to_skb(struct sk_buff *skb, struct __sk_buff *__skb) { struct qdisc_skb_cb *cb = (struct qdisc_skb_cb *)skb->cb; - if (!skb->len) - return -EINVAL; - if (!__skb) return 0; diff --git a/net/core/filter.c b/net/core/filter.c index bb0136e7a8e4..b35f642d117f 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2124,6 +2124,11 @@ static int __bpf_redirect_no_mac(struct sk_buff *skb, struct net_device *dev, { unsigned int mlen = skb_network_offset(skb); + if (unlikely(skb->len <= mlen)) { + kfree_skb(skb); + return -ERANGE; + } + if (mlen) { __skb_pull(skb, mlen); @@ -2145,7 +2150,7 @@ static int __bpf_redirect_common(struct sk_buff *skb, struct net_device *dev, u32 flags) { /* Verify that a link layer header is carried */ - if (unlikely(skb->mac_header >= skb->network_header)) { + if (unlikely(skb->mac_header >= skb->network_header || skb->len == 0)) { kfree_skb(skb); return -ERANGE; } |