All of lore.kernel.org
 help / color / mirror / Atom feed
From: John Fastabend <john.fastabend@gmail.com>
To: lmb@cloudflare.com, jakub@cloudflare.com, daniel@iogearbox.net
Cc: netdev@vger.kernel.org, bpf@vger.kernel.org,
	john.fastabend@gmail.com, ast@kernel.org
Subject: [bpf-next PATCH v2 01/12] bpf: sockmap, msg_pop_data can incorrecty set an sge length
Date: Wed, 13 May 2020 12:12:30 -0700	[thread overview]
Message-ID: <158939715042.15176.13948401431530778597.stgit@john-Precision-5820-Tower> (raw)
In-Reply-To: <158939706939.15176.10993188758954570904.stgit@john-Precision-5820-Tower>

When sk_msg_pop() is called where the pop operation is working on
the end of a sge element and there is no additional trailing data
and there _is_ data in front of pop, like the following case,


   |____________a_____________|__pop__|

We have out of order operations where we incorrectly set the pop
variable so that instead of zero'ing pop we incorrectly leave it
untouched, effectively. This can cause later logic to shift the
buffers around believing it should pop extra space. The result is
we have 'popped' more data then we expected potentially breaking
program logic.

It took us a while to hit this case because typically we pop headers
which seem to rarely be at the end of a scatterlist elements but
we can't rely on this.

Fixes: 7246d8ed4dcce ("bpf: helper to pop data from messages")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
---
 0 files changed

diff --git a/net/core/filter.c b/net/core/filter.c
index da06349..dfb4f24 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2579,8 +2579,8 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,
 			}
 			pop = 0;
 		} else if (pop >= sge->length - a) {
-			sge->length = a;
 			pop -= (sge->length - a);
+			sge->length = a;
 		}
 	}
 


  reply	other threads:[~2020-05-13 19:12 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-13 19:12 [bpf-next PATCH v2 00/12] bpf: selftests, test_sockmap improvements John Fastabend
2020-05-13 19:12 ` John Fastabend [this message]
2020-05-13 19:12 ` [bpf-next PATCH v2 02/12] bpf: sockmap, bpf_tcp_ingress needs to subtract bytes from sg.size John Fastabend
2020-05-13 19:13 ` [bpf-next PATCH v2 03/12] bpf: selftests, move sockmap bpf prog header into progs John Fastabend
2020-05-13 19:13 ` [bpf-next PATCH v2 04/12] bpf: selftests, remove prints from sockmap tests John Fastabend
2020-05-13 19:13 ` [bpf-next PATCH v2 05/12] bpf: selftests, sockmap test prog run without setting cgroup John Fastabend
2020-05-13 19:14 ` [bpf-next PATCH v2 06/12] bpf: selftests, print error in test_sockmap error cases John Fastabend
2020-05-13 19:14 ` [bpf-next PATCH v2 07/12] bpf: selftests, improve test_sockmap total bytes counter John Fastabend
2020-05-13 19:14 ` [bpf-next PATCH v2 08/12] bpf: selftests, break down test_sockmap into subtests John Fastabend
2020-05-13 19:15 ` [bpf-next PATCH v2 09/12] bpf: selftests, provide verbose option for selftests execution John Fastabend
2020-05-13 19:15 ` [bpf-next PATCH v2 10/12] bpf: selftests, add whitelist option to test_sockmap John Fastabend
2020-05-13 19:15 ` [bpf-next PATCH v2 11/12] bpf: selftests, add blacklist " John Fastabend
2020-05-13 19:16 ` [bpf-next PATCH v2 12/12] bpf: selftests, add ktls tests " John Fastabend
2020-05-16  1:02 ` [bpf-next PATCH v2 00/12] bpf: selftests, test_sockmap improvements Daniel Borkmann

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=158939715042.15176.13948401431530778597.stgit@john-Precision-5820-Tower \
    --to=john.fastabend@gmail.com \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=jakub@cloudflare.com \
    --cc=lmb@cloudflare.com \
    --cc=netdev@vger.kernel.org \
    --subject='Re: [bpf-next PATCH v2 01/12] bpf: sockmap, msg_pop_data can incorrecty set an sge length' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.