* [PATCH bpf-next] bpf: use nla_ok() instead of checking nla_len directly
@ 2023-12-18 23:19 Jakub Kicinski
2023-12-19 11:00 ` Simon Horman
2023-12-19 14:30 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Jakub Kicinski @ 2023-12-18 23:19 UTC (permalink / raw)
To: ast
Cc: netdev, Jakub Kicinski, syzbot+f43a23b6e622797c7a28, martin.lau,
daniel, john.fastabend, andrii, song, yonghong.song, kpsingh, sdf,
haoluo, jolsa, keescook, bpf
nla_len may also be too short to be sane, in which case after
recent changes nla_len() will return a wrapped value.
Reported-by: syzbot+f43a23b6e622797c7a28@syzkaller.appspotmail.com
Fixes: 172db56d90d2 ("netlink: Return unsigned value for nla_len()")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: martin.lau@linux.dev
CC: daniel@iogearbox.net
CC: john.fastabend@gmail.com
CC: ast@kernel.org
CC: andrii@kernel.org
CC: song@kernel.org
CC: yonghong.song@linux.dev
CC: kpsingh@kernel.org
CC: sdf@google.com
CC: haoluo@google.com
CC: jolsa@kernel.org
CC: keescook@chromium.org
CC: bpf@vger.kernel.org
---
net/core/filter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index 6d89a9cf33c9..24061f29c9dd 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -203,7 +203,7 @@ BPF_CALL_3(bpf_skb_get_nlattr_nest, struct sk_buff *, skb, u32, a, u32, x)
return 0;
nla = (struct nlattr *) &skb->data[a];
- if (nla->nla_len > skb->len - a)
+ if (!nla_ok(nla, skb->len - a))
return 0;
nla = nla_find_nested(nla, x);
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next] bpf: use nla_ok() instead of checking nla_len directly
2023-12-18 23:19 [PATCH bpf-next] bpf: use nla_ok() instead of checking nla_len directly Jakub Kicinski
@ 2023-12-19 11:00 ` Simon Horman
2023-12-19 14:30 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Simon Horman @ 2023-12-19 11:00 UTC (permalink / raw)
To: Jakub Kicinski
Cc: ast, netdev, syzbot+f43a23b6e622797c7a28, martin.lau, daniel,
john.fastabend, andrii, song, yonghong.song, kpsingh, sdf, haoluo,
jolsa, keescook, bpf
On Mon, Dec 18, 2023 at 03:19:04PM -0800, Jakub Kicinski wrote:
> nla_len may also be too short to be sane, in which case after
> recent changes nla_len() will return a wrapped value.
>
> Reported-by: syzbot+f43a23b6e622797c7a28@syzkaller.appspotmail.com
> Fixes: 172db56d90d2 ("netlink: Return unsigned value for nla_len()")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next] bpf: use nla_ok() instead of checking nla_len directly
2023-12-18 23:19 [PATCH bpf-next] bpf: use nla_ok() instead of checking nla_len directly Jakub Kicinski
2023-12-19 11:00 ` Simon Horman
@ 2023-12-19 14:30 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2023-12-19 14:30 UTC (permalink / raw)
To: Jakub Kicinski
Cc: ast, netdev, syzbot+f43a23b6e622797c7a28, martin.lau, daniel,
john.fastabend, andrii, song, yonghong.song, kpsingh, sdf, haoluo,
jolsa, keescook, bpf
Hello:
This patch was applied to bpf/bpf-next.git (master)
by Daniel Borkmann <daniel@iogearbox.net>:
On Mon, 18 Dec 2023 15:19:04 -0800 you wrote:
> nla_len may also be too short to be sane, in which case after
> recent changes nla_len() will return a wrapped value.
>
> Reported-by: syzbot+f43a23b6e622797c7a28@syzkaller.appspotmail.com
> Fixes: 172db56d90d2 ("netlink: Return unsigned value for nla_len()")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
>
> [...]
Here is the summary with links:
- [bpf-next] bpf: use nla_ok() instead of checking nla_len directly
https://git.kernel.org/bpf/bpf-next/c/2130c519a401
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-12-19 14:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-12-18 23:19 [PATCH bpf-next] bpf: use nla_ok() instead of checking nla_len directly Jakub Kicinski
2023-12-19 11:00 ` Simon Horman
2023-12-19 14:30 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox