From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lawrence Brakmo Subject: [PATCH bpf-next v10 01/12] bpf: Only reply field should be writeable Date: Thu, 25 Jan 2018 16:14:05 -0800 Message-ID: <20180126001416.1118158-2-brakmo@fb.com> References: <20180126001416.1118158-1-brakmo@fb.com> Mime-Version: 1.0 Content-Type: text/plain Cc: Kernel Team , Blake Matheny , Alexei Starovoitov , Daniel Borkmann , Eric Dumazet , Neal Cardwell , Yuchung Cheng To: netdev Return-path: Received: from mx0a-00082601.pphosted.com ([67.231.145.42]:46894 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751407AbeAZAOU (ORCPT ); Thu, 25 Jan 2018 19:14:20 -0500 Received: from pps.filterd (m0109334.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w0Q0DD1K018077 for ; Thu, 25 Jan 2018 16:14:20 -0800 Received: from mail.thefacebook.com ([199.201.64.23]) by mx0a-00082601.pphosted.com with ESMTP id 2fqp4eghg4-3 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 25 Jan 2018 16:14:20 -0800 In-Reply-To: <20180126001416.1118158-1-brakmo@fb.com> Sender: netdev-owner@vger.kernel.org List-ID: Currently, a sock_ops BPF program can write the op field and all the reply fields (reply and replylong). This is a bug. The op field should not have been writeable and there is currently no way to use replylong field for indices >= 1. This patch enforces that only the reply field (which equals replylong[0]) is writeable. Fixes: 40304b2a1567 ("bpf: BPF support for sock_ops") Signed-off-by: Lawrence Brakmo Acked-by: Yuchung Cheng --- net/core/filter.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 18da42a..bf9bb75 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -3845,8 +3845,7 @@ static bool sock_ops_is_valid_access(int off, int size, { if (type == BPF_WRITE) { switch (off) { - case offsetof(struct bpf_sock_ops, op) ... - offsetof(struct bpf_sock_ops, replylong[3]): + case offsetof(struct bpf_sock_ops, reply): break; default: return false; -- 2.9.5