diff options
| author | Stanislav Fomichev <sdf@google.com> | 2022-11-21 19:03:39 +0100 |
|---|---|---|
| committer | Martin KaFai Lau <martin.lau@kernel.org> | 2022-11-21 21:47:04 +0100 |
| commit | 114039b342014680911c35bd6b72624180fd669a (patch) | |
| tree | d1daa22b3d367f3837bf0c2a939b439b61723978 /net/core | |
| parent | selftests/bpf: Add test for cgroup iterator on a dead cgroup (diff) | |
| download | linux-114039b342014680911c35bd6b72624180fd669a.tar.xz linux-114039b342014680911c35bd6b72624180fd669a.zip | |
bpf: Move skb->len == 0 checks into __bpf_redirect
To avoid potentially breaking existing users.
Both mac/no-mac cases have to be amended; mac_header >= network_header
is not enough (verified with a new test, see next patch).
Fixes: fd1894224407 ("bpf: Don't redirect packets with invalid pkt_len")
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/r/20221121180340.1983627-1-sdf@google.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Diffstat (limited to 'net/core')
| -rw-r--r-- | net/core/filter.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/net/core/filter.c b/net/core/filter.c index 2a105fb1ceb2..b6e1b81cdfae 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2124,12 +2124,13 @@ static int __bpf_redirect_no_mac(struct sk_buff *skb, struct net_device *dev, { unsigned int mlen = skb_network_offset(skb); + if (unlikely(skb->len <= mlen)) { + kfree_skb(skb); + return -ERANGE; + } + if (mlen) { __skb_pull(skb, mlen); - if (unlikely(!skb->len)) { - kfree_skb(skb); - return -ERANGE; - } /* At ingress, the mac header has already been pulled once. * At egress, skb_pospull_rcsum has to be done in case that @@ -2149,7 +2150,7 @@ static int __bpf_redirect_common(struct sk_buff *skb, struct net_device *dev, u32 flags) { /* Verify that a link layer header is carried */ - if (unlikely(skb->mac_header >= skb->network_header)) { + if (unlikely(skb->mac_header >= skb->network_header || skb->len == 0)) { kfree_skb(skb); return -ERANGE; } |