diff options
| author | Eric Dumazet <edumazet@google.com> | 2022-03-02 08:17:22 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-03-08 19:09:32 +0100 |
| commit | 24efaae03b0d093a40e91dce2b820bab03664bca (patch) | |
| tree | b0a3c8e04754a34504ec1ce7d78a43bd164e7352 /net | |
| parent | 8b0142c4143c1ca297dcf2c0cdd045d65dae2344 (diff) | |
bpf, sockmap: Do not ignore orig_len parameter
commit 60ce37b03917e593d8e5d8bcc7ec820773daf81d upstream.
Currently, sk_psock_verdict_recv() returns skb->len
This is problematic because tcp_read_sock() might have
passed orig_len < skb->len, due to the presence of TCP urgent data.
This causes an infinite loop from tcp_read_sock()
Followup patch will make tcp_read_sock() more robust vs bad actors.
Fixes: ef5659280eb1 ("bpf, sockmap: Allow skipping sk_skb parser program")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
Tested-by: Jakub Sitnicki <jakub@cloudflare.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20220302161723.3910001-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/core/skmsg.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/skmsg.c b/net/core/skmsg.c index 5dd5569f89bf..e4bb89599b44 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -943,7 +943,7 @@ static int sk_psock_verdict_recv(read_descriptor_t *desc, struct sk_buff *skb, struct sk_psock *psock; struct bpf_prog *prog; int ret = __SK_DROP; - int len = skb->len; + int len = orig_len; /* clone here so sk_eat_skb() in tcp_read_sock does not drop our data */ skb = skb_clone(skb, GFP_ATOMIC); |