| Message ID | 33711939695bf620703d60064c6242a8e4f4b64a.1544071106.git.sdf@google.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | [bpf,1/2] selftests/bpf: use thoff instead of nhoff in BPF flow dissector | expand |
On Wed, Dec 5, 2018 at 8:41 PM Stanislav Fomichev <sdf@google.com> wrote: > > We want to make sure that the following condition holds: > 0 <= nhoff <= thoff <= skb->len > > BPF program can set out-of-bounds nhoff and thoff, which is dangerous, see > recent commit d0c081b49137 ("flow_dissector: properly cap thoff field")'. > > Signed-off-by: Stanislav Fomichev <sdf@google.com> Acked-by: Song Liu <songliubraving@fb.com> > --- > net/core/flow_dissector.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c > index ff5556d80570..af68207ee56c 100644 > --- a/net/core/flow_dissector.c > +++ b/net/core/flow_dissector.c > @@ -791,9 +791,12 @@ bool __skb_flow_dissect(const struct sk_buff *skb, > /* Restore state */ > memcpy(cb, &cb_saved, sizeof(cb_saved)); > > + flow_keys.nhoff = clamp_t(u16, flow_keys.nhoff, 0, skb->len); > + flow_keys.thoff = clamp_t(u16, flow_keys.thoff, > + flow_keys.nhoff, skb->len); > + > __skb_flow_bpf_to_target(&flow_keys, flow_dissector, > target_container); > - key_control->thoff = min_t(u16, key_control->thoff, skb->len); > rcu_read_unlock(); > return result == BPF_OK; > } > -- > 2.20.0.rc1.387.gf8505762e3-goog >
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c index ff5556d80570..af68207ee56c 100644 --- a/net/core/flow_dissector.c +++ b/net/core/flow_dissector.c @@ -791,9 +791,12 @@ bool __skb_flow_dissect(const struct sk_buff *skb, /* Restore state */ memcpy(cb, &cb_saved, sizeof(cb_saved)); + flow_keys.nhoff = clamp_t(u16, flow_keys.nhoff, 0, skb->len); + flow_keys.thoff = clamp_t(u16, flow_keys.thoff, + flow_keys.nhoff, skb->len); + __skb_flow_bpf_to_target(&flow_keys, flow_dissector, target_container); - key_control->thoff = min_t(u16, key_control->thoff, skb->len); rcu_read_unlock(); return result == BPF_OK; }
We want to make sure that the following condition holds: 0 <= nhoff <= thoff <= skb->len BPF program can set out-of-bounds nhoff and thoff, which is dangerous, see recent commit d0c081b49137 ("flow_dissector: properly cap thoff field")'. Signed-off-by: Stanislav Fomichev <sdf@google.com> --- net/core/flow_dissector.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)