diff options
| author |   Tushar Dave <tushar.n.dave@oracle.com> | 2018-08-31 23:45:16 +0200 |
|---|---|---|
| committer |   Daniel Borkmann <daniel@iogearbox.net> | 2018-09-02 22:29:53 +0200 |
| commit | 9db39f4d4f94b61e4b64b077f6ddb2bdfb533a88 (patch) | |
| tree | a38eb4ddd5568fcd3647115dd0cae63c8fcf3bb4 /net/core/filter.c | |
| parent | ipv6: don't get lwtstate twice in ip6_rt_copy_init() (diff) | |
| download | linux-dev-9db39f4d4f94b61e4b64b077f6ddb2bdfb533a88.tar.xz linux-dev-9db39f4d4f94b61e4b64b077f6ddb2bdfb533a88.zip | |
bpf: Fix bpf_msg_pull_data()
Helper bpf_msg_pull_data() mistakenly reuses variable 'offset' while
linearizing multiple scatterlist elements. Variable 'offset' is used
to find first starting scatterlist element
i.e. msg->data = sg_virt(&sg[first_sg]) + start - offset"
Use different variable name while linearizing multiple scatterlist
elements so that value contained in variable 'offset' won't get
overwritten.
Fixes: 015632bb30da ("bpf: sk_msg program helper bpf_sk_msg_pull_data")
Signed-off-by: Tushar Dave <tushar.n.dave@oracle.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat (limited to 'net/core/filter.c')
| -rw-r--r-- | net/core/filter.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/net/core/filter.c b/net/core/filter.c index 2c7801f6737a..aecdeba052d3 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2292,7 +2292,7 @@ static const struct bpf_func_proto bpf_msg_cork_bytes_proto = { BPF_CALL_4(bpf_msg_pull_data, struct sk_msg_buff *, msg, u32, start, u32, end, u64, flags) { - unsigned int len = 0, offset = 0, copy = 0; + unsigned int len = 0, offset = 0, copy = 0, poffset = 0; int bytes = end - start, bytes_sg_total; struct scatterlist *sg = msg->sg_data; int first_sg, last_sg, i, shift; @@ -2348,16 +2348,15 @@ BPF_CALL_4(bpf_msg_pull_data, if (unlikely(!page)) return -ENOMEM; p = page_address(page); - offset = 0; i = first_sg; do { from = sg_virt(&sg[i]); len = sg[i].length; - to = p + offset; + to = p + poffset; memcpy(to, from, len); - offset += len; + poffset += len; sg[i].length = 0; put_page(sg_page(&sg[i])); |