]> git.baikalelectronics.ru Git - kernel.git/commit
bpf: fix out-of-bounds read in __bpf_skc_lookup
authorLorenz Bauer <lmb@cloudflare.com>
Tue, 21 May 2019 07:52:38 +0000 (08:52 +0100)
committerDaniel Borkmann <daniel@iogearbox.net>
Tue, 21 May 2019 14:25:09 +0000 (16:25 +0200)
commit523e517b24c2e33d252c5e573a80b5390e5c7004
tree9f4de06e34f7e88112812578ad1a9a922b358197
parenteea00103ae2e52431db0058db9783dcec21c5d15
bpf: fix out-of-bounds read in __bpf_skc_lookup

__bpf_skc_lookup takes a socket tuple and the length of the
tuple as an argument. Based on the length, it decides which
address family to pass to the helper function sk_lookup.

In case of AF_INET6, it fails to verify that the length
of the tuple is long enough. sk_lookup may therefore access
data past the end of the tuple.

Fixes: 4b8337ef7be8 ("bpf: Add helper to retrieve socket in BPF")
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
net/core/filter.c