* [PATCH bpf] bpf: fix out-of-bounds read in __bpf_skc_lookup
@ 2019-05-21 7:52 Lorenz Bauer
2019-05-21 14:47 ` Daniel Borkmann
0 siblings, 1 reply; 2+ messages in thread
From: Lorenz Bauer @ 2019-05-21 7:52 UTC (permalink / raw)
To: netdev, bpf, ast, daniel; +Cc: joe, Lorenz Bauer
__bpf_skc_lookup takes a socket tuple and the length of the
tuple as an argument. Based on the length, it decides which
address family to pass to the helper function sk_lookup.
In case of AF_INET6, it fails to verify that the length
of the tuple is long enough. sk_lookup may therefore access
data past the end of the tuple.
Fixes: 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF")
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
---
net/core/filter.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index 55bfc941d17a..76f1d99640e2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -5304,7 +5304,13 @@ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len,
struct net *net;
int sdif;
- family = len == sizeof(tuple->ipv4) ? AF_INET : AF_INET6;
+ if (len == sizeof(tuple->ipv4))
+ family = AF_INET;
+ else if (len == sizeof(tuple->ipv6))
+ family = AF_INET6;
+ else
+ return NULL;
+
if (unlikely(family == AF_UNSPEC || flags ||
!((s32)netns_id < 0 || netns_id <= S32_MAX)))
goto out;
--
2.19.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH bpf] bpf: fix out-of-bounds read in __bpf_skc_lookup
2019-05-21 7:52 [PATCH bpf] bpf: fix out-of-bounds read in __bpf_skc_lookup Lorenz Bauer
@ 2019-05-21 14:47 ` Daniel Borkmann
0 siblings, 0 replies; 2+ messages in thread
From: Daniel Borkmann @ 2019-05-21 14:47 UTC (permalink / raw)
To: Lorenz Bauer, netdev, bpf, ast, daniel; +Cc: joe
On 05/21/2019 09:52 AM, Lorenz Bauer wrote:
> __bpf_skc_lookup takes a socket tuple and the length of the
> tuple as an argument. Based on the length, it decides which
> address family to pass to the helper function sk_lookup.
>
> In case of AF_INET6, it fails to verify that the length
> of the tuple is long enough. sk_lookup may therefore access
> data past the end of the tuple.
>
> Fixes: 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF")
> Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Applied, thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-05-21 14:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-21 7:52 [PATCH bpf] bpf: fix out-of-bounds read in __bpf_skc_lookup Lorenz Bauer
2019-05-21 14:47 ` Daniel Borkmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).