On Wed, Dec 5, 2018 at 8:41 PM Stanislav Fomichev <s...@google.com> wrote:
>
> We want to make sure that the following condition holds:
> 0 <= nhoff <= thoff <= skb->len
>
> BPF program can set out-of-bounds nhoff and thoff, which is dangerous, see
> recent commit d0c081b49137 ("flow_dissector: properly cap thoff field")'.
>
> Signed-off-by: Stanislav Fomichev <s...@google.com>Acked-by: Song Liu <songliubrav...@fb.com> > --- > net/core/flow_dissector.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c > index ff5556d80570..af68207ee56c 100644 > --- a/net/core/flow_dissector.c > +++ b/net/core/flow_dissector.c > @@ -791,9 +791,12 @@ bool __skb_flow_dissect(const struct sk_buff *skb, > /* Restore state */ > memcpy(cb, &cb_saved, sizeof(cb_saved)); > > + flow_keys.nhoff = clamp_t(u16, flow_keys.nhoff, 0, skb->len); > + flow_keys.thoff = clamp_t(u16, flow_keys.thoff, > + flow_keys.nhoff, skb->len); > + > __skb_flow_bpf_to_target(&flow_keys, flow_dissector, > target_container); > - key_control->thoff = min_t(u16, key_control->thoff, skb->len); > rcu_read_unlock(); > return result == BPF_OK; > } > -- > 2.20.0.rc1.387.gf8505762e3-goog >
