Commit 5d66fa7d authored Oct 24, 2018 by Daniel Borkmann Committed by Alexei Starovoitov Oct 25, 2018

bpf: fix direct packet access for flow dissector progs

Commit d58e468b ("flow_dissector: implements flow dissector BPF
hook") added direct packet access for skbs in may_access_direct_pkt_data()
function where this enables read and write access to the skb->data. This
is buggy because without a prologue generator such as bpf_unclone_prologue()
we would allow for writing into cloned skbs. Original intention might have
been to only allow read access where this is not needed (similar as the
flow_dissector_func_proto() indicates which enables only bpf_skb_load_bytes()
as well), therefore this patch fixes it to restrict to read-only.

Fixes: d58e468b ("flow_dissector: implements flow dissector BPF hook")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Cc: Petar Penkov <ppenkov@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

parent ab21c1b5

kernel/bpf/verifier.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -1387,21 +1387,23 @@ static bool may_access_direct_pkt_data(struct bpf_verifier_env *env,
		enum bpf_access_type t)
		{
		switch (env->prog->type) {
		/* Program types only with direct read access go here! */
		case BPF_PROG_TYPE_LWT_IN:
		case BPF_PROG_TYPE_LWT_OUT:
		case BPF_PROG_TYPE_LWT_SEG6LOCAL:
		case BPF_PROG_TYPE_SK_REUSEPORT:
		/* dst_input() and dst_output() can't write for now */
		case BPF_PROG_TYPE_FLOW_DISSECTOR:
		if (t == BPF_WRITE)
		return false;
		/* fallthrough */

		/* Program types with direct read + write access go here! */
		case BPF_PROG_TYPE_SCHED_CLS:
		case BPF_PROG_TYPE_SCHED_ACT:
		case BPF_PROG_TYPE_XDP:
		case BPF_PROG_TYPE_LWT_XMIT:
		case BPF_PROG_TYPE_SK_SKB:
		case BPF_PROG_TYPE_SK_MSG:
		case BPF_PROG_TYPE_FLOW_DISSECTOR:
		if (meta)
		return meta->pkt_access;