path: root/include/net/ipv6.h
diff options
authorJesper Dangaard Brouer <brouer@redhat.com>2018-04-17 16:46:43 +0200
committerDavid S. Miller <davem@davemloft.net>2018-04-17 10:50:30 -0400
commit6dfb970d3dbd6bf274c4bf003ca8ab4a51dc66c7 (patch)
tree1f162a8267f6647ca930ef202dfc9ad0b0245fae /include/net/ipv6.h
parentxdp: transition into using xdp_frame for ndo_xdp_xmit (diff)
xdp: avoid leaking info stored in frame data on page reuse
The bpf infrastructure and verifier goes to great length to avoid bpf progs leaking kernel (pointer) info. For queueing an xdp_buff via XDP_REDIRECT, xdp_frame info stores kernel info (incl pointers) in top part of frame data (xdp->data_hard_start). Checks are in place to assure enough headroom is available for this. This info is not cleared, and if the frame is reused, then a malicious user could use bpf_xdp_adjust_head helper to move xdp->data into this area. Thus, making this area readable. This is not super critical as XDP progs requires root or CAP_SYS_ADMIN, which are privileged enough for such info. An effort (is underway) towards moving networking bpf hooks to the lesser privileged mode CAP_NET_ADMIN, where leaking such info should be avoided. Thus, this patch to clear the info when needed. Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions