bpf: bpf_compute_data uses incorrect cb structure

Linux Kernel / Linux Kernel - John Fastabend [gmail.com] - 29 October 2017 02:18 EDT

SK_SKB program types use bpf_compute_data to store the end of the packet data. However, bpf_compute_data assumes the cb is stored in the qdisc layer format. But, for SK_SKB this is the wrong layer of the stack for this type.

It happens to work (sort of!) because in most cases nothing happens to be overwritten today. This is very fragile and error prone. Fortunately, we have another hole in tcp_skb_cb we can use so lets put the data_end value there.

Note, SK_SKB program types do not use data_meta, they are failed by sk_skb_is_valid_access().

8108a7751512 bpf: bpf_compute_data uses incorrect cb structure
include/net/tcp.h | 1 +
kernel/bpf/sockmap.c | 12 ++++++++++--
net/core/filter.c | 27 ++++++++++++++++++++++++++-
3 files changed, 37 insertions(+), 3 deletions(-)

Upstream: git.kernel.org


  • Share