From: John Fastabend <john.fastabend@gmail.com>
To: Cong Wang <xiyou.wangcong@gmail.com>, netdev@vger.kernel.org
Cc: bpf@vger.kernel.org, Cong Wang <cong.wang@bytedance.com>,
John Fastabend <john.fastabend@gmail.com>,
Daniel Borkmann <daniel@iogearbox.net>
Subject: RE: [Patch bpf v3 1/4] bpf: Check negative offsets in __bpf_skb_min_len()
Date: Fri, 20 Dec 2024 09:51:28 -0800 [thread overview]
Message-ID: <6765aea049149_21de2208b@john.notmuch> (raw)
In-Reply-To: <20241213034057.246437-2-xiyou.wangcong@gmail.com>
Cong Wang wrote:
> From: Cong Wang <cong.wang@bytedance.com>
>
> skb_network_offset() and skb_transport_offset() can be negative when
> they are called after we pull the transport header, for example, when
> we use eBPF sockmap at the point of ->sk_data_ready().
>
> __bpf_skb_min_len() uses an unsigned int to get these offsets, this
> leads to a very large number which then causes bpf_skb_change_tail()
> failed unexpectedly.
>
> Fix this by using a signed int to get these offsets and ensure the
> minimum is at least zero.
>
> Fixes: 5293efe62df8 ("bpf: add bpf_skb_change_tail helper")
> Cc: John Fastabend <john.fastabend@gmail.com>
> Cc: Daniel Borkmann <daniel@iogearbox.net>
> Signed-off-by: Cong Wang <cong.wang@bytedance.com>
> ---
Acked-by: John Fastabend <john.fastabend@gmail.com>
next prev parent reply other threads:[~2024-12-20 17:51 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-12-13 3:40 [Patch bpf v3 0/4] bpf: a bug fix and test cases for bpf_skb_change_tail() Cong Wang
2024-12-13 3:40 ` [Patch bpf v3 1/4] bpf: Check negative offsets in __bpf_skb_min_len() Cong Wang
2024-12-20 17:51 ` John Fastabend [this message]
2024-12-13 3:40 ` [Patch bpf v3 2/4] selftests/bpf: Add a BPF selftest for bpf_skb_change_tail() Cong Wang
2024-12-20 17:52 ` John Fastabend
2024-12-13 3:40 ` [Patch bpf v3 3/4] selftests/bpf: Introduce socket_helpers.h for TC tests Cong Wang
2024-12-20 17:53 ` John Fastabend
2024-12-13 3:40 ` [Patch bpf v3 4/4] selftests/bpf: Test bpf_skb_change_tail() in TC ingress Cong Wang
2024-12-20 17:55 ` John Fastabend
2024-12-20 22:20 ` [Patch bpf v3 0/4] bpf: a bug fix and test cases for bpf_skb_change_tail() patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6765aea049149_21de2208b@john.notmuch \
--to=john.fastabend@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=cong.wang@bytedance.com \
--cc=daniel@iogearbox.net \
--cc=netdev@vger.kernel.org \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.