Commit ec3d837a authored Dec 05, 2018 by Stanislav Fomichev Committed by Alexei Starovoitov Dec 07, 2018

net/flow_dissector: correctly cap nhoff and thoff in case of BPF



We want to make sure that the following condition holds:
0 <= nhoff <= thoff <= skb->len

BPF program can set out-of-bounds nhoff and thoff, which is dangerous, see
recent commit d0c081b4 ("flow_dissector: properly cap thoff field")'.

Signed-off-by: Stanislav Fomichev <sdf@google.com>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

parent 13e56ec2

net/core/flow_dissector.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -791,9 +791,12 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
		/* Restore state */
		memcpy(cb, &cb_saved, sizeof(cb_saved));

		flow_keys.nhoff = clamp_t(u16, flow_keys.nhoff, 0, skb->len);
		flow_keys.thoff = clamp_t(u16, flow_keys.thoff,
		flow_keys.nhoff, skb->len);

		__skb_flow_bpf_to_target(&flow_keys, flow_dissector,
		target_container);
		key_control->thoff = min_t(u16, key_control->thoff, skb->len);
		rcu_read_unlock();
		return result == BPF_OK;
		}