From: Martin KaFai Lau <martin.lau@kernel.org>

Date: Thu, 16 Feb 2023 16:41:48 -0800

Subject: [PATCH] bpf: bpf_fib_lookup should not return neigh in NUD_FAILED

 state

References: bsc#1012628

Patch-mainline: 6.2.2

Git-commit: 1fe4850b34ab512ff911e2c035c75fb6438f7307

commit 1fe4850b34ab512ff911e2c035c75fb6438f7307 upstream.

The bpf_fib_lookup() helper does not only look up the fib (ie. route)

but it also looks up the neigh. Before returning the neigh, the helper

does not check for NUD_VALID. When a neigh state (neigh->nud_state)

is in NUD_FAILED, its dmac (neigh->ha) could be all zeros. The helper

still returns SUCCESS instead of NO_NEIGH in this case. Because of the

SUCCESS return value, the bpf prog directly uses the returned dmac

and ends up filling all zero in the eth header.

This patch checks for NUD_VALID and returns NO_NEIGH if the neigh is

not valid.

Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

Link: https://lore.kernel.org/bpf/20230217004150.2980689-3-martin.lau@linux.dev

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Jiri Slaby <jslaby@suse.cz>

---

 net/core/filter.c | 4 ++--

 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/filter.c b/net/core/filter.c

index 43cc1fe5..a00a4b54 100644

--- a/net/core/filter.c

+++ b/net/core/filter.c

@@ -5816,7 +5816,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,

 		neigh = __ipv6_neigh_lookup_noref_stub(dev, dst);

 	}

-	if (!neigh)

+	if (!neigh || !(neigh->nud_state & NUD_VALID))

 		return BPF_FIB_LKUP_RET_NO_NEIGH;

 	return bpf_fib_set_fwd_params(params, neigh, dev, mtu);

@@ -5931,7 +5931,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,

 	 * not needed here.

 	 */

 	neigh = __ipv6_neigh_lookup_noref_stub(dev, dst);

-	if (!neigh)

+	if (!neigh || !(neigh->nud_state & NUD_VALID))

 		return BPF_FIB_LKUP_RET_NO_NEIGH;

 	return bpf_fib_set_fwd_params(params, neigh, dev, mtu);

-- 

2.35.3