Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b4b89b7b authored by John Fastabend's avatar John Fastabend Committed by Greg Kroah-Hartman
Browse files

bpf: sockmap, updating the sg structure should also update curr 



[ Upstream commit bb9aefde5bbaf6c168c77ba635c155b4980c2287 ]

Curr pointer should be updated when the sg structure is shifted.

Fixes: 7246d8ed ("bpf: helper to pop data from messages")
Signed-off-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/r/20231206232706.374377-3-john.fastabend@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 7ffff0cc

net/core/filter.c

+19 −0
Original line number Diff line number Diff line
@@ -2219,6 +2219,22 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg, u32, bytes) 
	return 0;

}



static void sk_msg_reset_curr(struct sk_msg *msg)

{

	u32 i = msg->sg.start;

	u32 len = 0;



	do {

		len += sk_msg_elem(msg, i)->length;

		sk_msg_iter_var_next(i);

		if (len >= msg->sg.size)

			break;

	} while (i != msg->sg.end);



	msg->sg.curr = i;

	msg->sg.copybreak = 0;

}



static const struct bpf_func_proto bpf_msg_cork_bytes_proto = {

	.func           = bpf_msg_cork_bytes,

	.gpl_only       = false,
@@ -2338,6 +2354,7 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_msg *, msg, u32, start, 
		      msg->sg.end - shift + NR_MSG_FRAG_IDS :

		      msg->sg.end - shift;

out:

	sk_msg_reset_curr(msg);

	msg->data = sg_virt(&msg->sg.data[first_sge]) + start - offset;

	msg->data_end = msg->data + bytes;

	return 0;
@@ -2471,6 +2488,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, 
		msg->sg.data[new] = rsge;

	}



	sk_msg_reset_curr(msg);

	sk_msg_compute_data_pointers(msg);

	return 0;

}
@@ -2642,6 +2660,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, 


	sk_mem_uncharge(msg->sk, len - pop);

	msg->sg.size -= (len - pop);

	sk_msg_reset_curr(msg);

	sk_msg_compute_data_pointers(msg);

	return 0;

}