From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tushar Dave Subject: [PATCH net] bpf: Fix bpf_msg_pull_data() Date: Fri, 31 Aug 2018 23:45:16 +0200 Message-ID: <1535751916-11880-1-git-send-email-tushar.n.dave@oracle.com> Cc: sowmini.varadhan@oracle.com To: john.fastabend@gmail.com, ast@kernel.org, daniel@iogearbox.net, davem@davemloft.net, netdev@vger.kernel.org Return-path: Received: from userp2130.oracle.com ([156.151.31.86]:58852 "EHLO userp2130.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727201AbeIABzM (ORCPT ); Fri, 31 Aug 2018 21:55:12 -0400 Sender: netdev-owner@vger.kernel.org List-ID: Helper bpf_msg_pull_data() mistakenly reuses variable 'offset' while linearizing multiple scatterlist elements. Variable 'offset' is used to find first starting scatterlist element i.e. msg->data = sg_virt(&sg[first_sg]) + start - offset" Use different variable name while linearizing multiple scatterlist elements so that value contained in variable 'offset' won't get overwritten. Fixes: 015632bb30da ("bpf: sk_msg program helper bpf_sk_msg_pull_data") Signed-off-by: Tushar Dave --- net/core/filter.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 2c7801f..aecdeba 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2292,7 +2292,7 @@ struct sock *do_msg_redirect_map(struct sk_msg_buff *msg) BPF_CALL_4(bpf_msg_pull_data, struct sk_msg_buff *, msg, u32, start, u32, end, u64, flags) { - unsigned int len = 0, offset = 0, copy = 0; + unsigned int len = 0, offset = 0, copy = 0, poffset = 0; int bytes = end - start, bytes_sg_total; struct scatterlist *sg = msg->sg_data; int first_sg, last_sg, i, shift; @@ -2348,16 +2348,15 @@ struct sock *do_msg_redirect_map(struct sk_msg_buff *msg) if (unlikely(!page)) return -ENOMEM; p = page_address(page); - offset = 0; i = first_sg; do { from = sg_virt(&sg[i]); len = sg[i].length; - to = p + offset; + to = p + poffset; memcpy(to, from, len); - offset += len; + poffset += len; sg[i].length = 0; put_page(sg_page(&sg[i])); -- 1.8.3.1