diff options
| author | Paul Chaignon <paul.chaignon@gmail.com> | 2025-08-01 11:48:15 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-08-15 12:13:59 +0200 |
| commit | 258d42024fadbc5eaaf08ec59a6d376b0d4c1258 (patch) | |
| tree | 81bc137f2fb1abce94b7cf944f0c5dfbc633d378 | |
| parent | eb2035c1adeb7d67402fb56d64e22a1dd57d4c29 (diff) | |
bpf: Check netfilter ctx accesses are aligned
[ Upstream commit 9e6448f7b1efb27f8d508b067ecd33ed664a4246 ]
Similarly to the previous patch fixing the flow_dissector ctx accesses,
nf_is_valid_access also doesn't check that ctx accesses are aligned.
Contrary to flow_dissector programs, netfilter programs don't have
context conversion. The unaligned ctx accesses are therefore allowed by
the verifier.
Fixes: fd9c663b9ad6 ("bpf: minimal support for programs hooked into netfilter framework")
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/853ae9ed5edaa5196e8472ff0f1bb1cc24059214.1754039605.git.paul.chaignon@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/netfilter/nf_bpf_link.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/netfilter/nf_bpf_link.c b/net/netfilter/nf_bpf_link.c index be3f72fcc678..b5e4ca9026a8 100644 --- a/net/netfilter/nf_bpf_link.c +++ b/net/netfilter/nf_bpf_link.c @@ -295,6 +295,9 @@ static bool nf_is_valid_access(int off, int size, enum bpf_access_type type, if (off < 0 || off >= sizeof(struct bpf_nf_ctx)) return false; + if (off % size != 0) + return false; + if (type == BPF_WRITE) return false; |