diff options
| author | Lorenz Bauer <lmb@cloudflare.com> | 2019-05-21 09:52:38 +0200 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2019-05-21 16:25:09 +0200 |
| commit | 9b28ae243ef3b13d8a88b5451d025475c75ebdef (patch) | |
| tree | 9f4de06e34f7e88112812578ad1a9a922b358197 /net/core | |
| parent | Documentation/networking: fix af_xdp.rst Sphinx warnings (diff) | |
| download | linux-9b28ae243ef3b13d8a88b5451d025475c75ebdef.tar.xz linux-9b28ae243ef3b13d8a88b5451d025475c75ebdef.zip | |
bpf: fix out-of-bounds read in __bpf_skc_lookup
__bpf_skc_lookup takes a socket tuple and the length of the
tuple as an argument. Based on the length, it decides which
address family to pass to the helper function sk_lookup.
In case of AF_INET6, it fails to verify that the length
of the tuple is long enough. sk_lookup may therefore access
data past the end of the tuple.
Fixes: 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF")
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat (limited to 'net/core')
| -rw-r--r-- | net/core/filter.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/net/core/filter.c b/net/core/filter.c index 55bfc941d17a..76f1d99640e2 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -5304,7 +5304,13 @@ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, struct net *net; int sdif; - family = len == sizeof(tuple->ipv4) ? AF_INET : AF_INET6; + if (len == sizeof(tuple->ipv4)) + family = AF_INET; + else if (len == sizeof(tuple->ipv6)) + family = AF_INET6; + else + return NULL; + if (unlikely(family == AF_UNSPEC || flags || !((s32)netns_id < 0 || netns_id <= S32_MAX))) goto out; |