diff options
| author | Paul Chaignon <paul.chaignon@gmail.com> | 2025-08-01 11:47:23 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-08-15 16:39:15 +0200 |
| commit | 7c1a3fc996fa5b0ae50e16bc3a02c63e560a0d9d (patch) | |
| tree | 926a8164092cecfeec45ccdecc416a223b3d2ecf | |
| parent | 3fe763963289b5072a03e5ef1c8cb3f7bd46597c (diff) | |
bpf: Check flow_dissector ctx accesses are aligned
[ Upstream commit ead3d7b2b6afa5ee7958620c4329982a7d9c2b78 ]
flow_dissector_is_valid_access doesn't check that the context access is
aligned. As a consequence, an unaligned access within one of the exposed
field is considered valid and later rejected by
flow_dissector_convert_ctx_access when we try to convert it.
The later rejection is problematic because it's reported as a verifier
bug with a kernel warning and doesn't point to the right instruction in
verifier logs.
Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
Reported-by: syzbot+ccac90e482b2a81d74aa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ccac90e482b2a81d74aa
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/cc1b036be484c99be45eddf48bd78cc6f72839b1.1754039605.git.paul.chaignon@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/core/filter.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/core/filter.c b/net/core/filter.c index 47073a0180a4..2c3196dadd54 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -9449,6 +9449,9 @@ static bool flow_dissector_is_valid_access(int off, int size, if (off < 0 || off >= sizeof(struct __sk_buff)) return false; + if (off % size != 0) + return false; + if (type == BPF_WRITE) return false; |