|
Shung-Hsi Yu |
08e21a |
From: Eric Dumazet <edumazet@google.com>
|
|
Shung-Hsi Yu |
08e21a |
Date: Wed, 2 Mar 2022 08:17:22 -0800
|
|
Shung-Hsi Yu |
08e21a |
Subject: bpf, sockmap: Do not ignore orig_len parameter
|
|
Shung-Hsi Yu |
08e21a |
Patch-mainline: v5.17-rc7
|
|
Shung-Hsi Yu |
08e21a |
Git-commit: 60ce37b03917e593d8e5d8bcc7ec820773daf81d
|
|
Shung-Hsi Yu |
08e21a |
References: jsc#PED-1368
|
|
Shung-Hsi Yu |
08e21a |
|
|
Shung-Hsi Yu |
08e21a |
Currently, sk_psock_verdict_recv() returns skb->len
|
|
Shung-Hsi Yu |
08e21a |
|
|
Shung-Hsi Yu |
08e21a |
This is problematic because tcp_read_sock() might have
|
|
Shung-Hsi Yu |
08e21a |
passed orig_len < skb->len, due to the presence of TCP urgent data.
|
|
Shung-Hsi Yu |
08e21a |
|
|
Shung-Hsi Yu |
08e21a |
This causes an infinite loop from tcp_read_sock()
|
|
Shung-Hsi Yu |
08e21a |
|
|
Shung-Hsi Yu |
08e21a |
Followup patch will make tcp_read_sock() more robust vs bad actors.
|
|
Shung-Hsi Yu |
08e21a |
|
|
Shung-Hsi Yu |
08e21a |
Fixes: ef5659280eb1 ("bpf, sockmap: Allow skipping sk_skb parser program")
|
|
Shung-Hsi Yu |
08e21a |
Reported-by: syzbot <syzkaller@googlegroups.com>
|
|
Shung-Hsi Yu |
08e21a |
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
|
Shung-Hsi Yu |
08e21a |
Acked-by: John Fastabend <john.fastabend@gmail.com>
|
|
Shung-Hsi Yu |
08e21a |
Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
|
|
Shung-Hsi Yu |
08e21a |
Tested-by: Jakub Sitnicki <jakub@cloudflare.com>
|
|
Shung-Hsi Yu |
08e21a |
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
|
|
Shung-Hsi Yu |
08e21a |
Link: https://lore.kernel.org/r/20220302161723.3910001-1-eric.dumazet@gmail.com
|
|
Shung-Hsi Yu |
08e21a |
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Shung-Hsi Yu |
08e21a |
Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
|
|
Shung-Hsi Yu |
08e21a |
---
|
|
Shung-Hsi Yu |
08e21a |
net/core/skmsg.c | 2 +-
|
|
Shung-Hsi Yu |
08e21a |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
Shung-Hsi Yu |
08e21a |
|
|
Shung-Hsi Yu |
08e21a |
--- a/net/core/skmsg.c
|
|
Shung-Hsi Yu |
08e21a |
+++ b/net/core/skmsg.c
|
|
Shung-Hsi Yu |
08e21a |
@@ -1153,7 +1153,7 @@ static int sk_psock_verdict_recv(read_de
|
|
Shung-Hsi Yu |
08e21a |
struct sk_psock *psock;
|
|
Shung-Hsi Yu |
08e21a |
struct bpf_prog *prog;
|
|
Shung-Hsi Yu |
08e21a |
int ret = __SK_DROP;
|
|
Shung-Hsi Yu |
08e21a |
- int len = skb->len;
|
|
Shung-Hsi Yu |
08e21a |
+ int len = orig_len;
|
|
Shung-Hsi Yu |
08e21a |
|
|
Shung-Hsi Yu |
08e21a |
/* clone here so sk_eat_skb() in tcp_read_sock does not drop our data */
|
|
Shung-Hsi Yu |
08e21a |
skb = skb_clone(skb, GFP_ATOMIC);
|