diff options
| author | Tushar Dave <tushar.n.dave@oracle.com> | 2018-08-31 23:45:16 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-10-10 08:55:55 +0200 |
| commit | 23fa01c0fcb50519c53ac2c834c29d9b1dca3e25 (patch) | |
| tree | 7b282823f66f1e2fcfc7d6317b64c4eb98506b70 /net | |
| parent | 7e2069153a586a6fdaaf75f30428cf62f45dd737 (diff) | |
bpf: Fix bpf_msg_pull_data()
[ Upstream commit 9db39f4d4f94b61e4b64b077f6ddb2bdfb533a88 ]
Helper bpf_msg_pull_data() mistakenly reuses variable 'offset' while
linearizing multiple scatterlist elements. Variable 'offset' is used
to find first starting scatterlist element
i.e. msg->data = sg_virt(&sg[first_sg]) + start - offset"
Use different variable name while linearizing multiple scatterlist
elements so that value contained in variable 'offset' won't get
overwritten.
Fixes: 015632bb30da ("bpf: sk_msg program helper bpf_sk_msg_pull_data")
Signed-off-by: Tushar Dave <tushar.n.dave@oracle.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/core/filter.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/net/core/filter.c b/net/core/filter.c index a80b57e4aaed..963ee2e88861 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2282,7 +2282,7 @@ static const struct bpf_func_proto bpf_msg_cork_bytes_proto = { BPF_CALL_4(bpf_msg_pull_data, struct sk_msg_buff *, msg, u32, start, u32, end, u64, flags) { - unsigned int len = 0, offset = 0, copy = 0; + unsigned int len = 0, offset = 0, copy = 0, poffset = 0; int bytes = end - start, bytes_sg_total; struct scatterlist *sg = msg->sg_data; int first_sg, last_sg, i, shift; @@ -2338,16 +2338,15 @@ BPF_CALL_4(bpf_msg_pull_data, if (unlikely(!page)) return -ENOMEM; p = page_address(page); - offset = 0; i = first_sg; do { from = sg_virt(&sg[i]); len = sg[i].length; - to = p + offset; + to = p + poffset; memcpy(to, from, len); - offset += len; + poffset += len; sg[i].length = 0; put_page(sg_page(&sg[i])); |