diff options
| author |   Cong Wang <cong.wang@bytedance.com> | 2024-12-12 19:40:54 -0800 |
|---|---|---|
| committer |   Daniel Borkmann <daniel@iogearbox.net> | 2024-12-20 23:13:31 +0100 |
| commit | 9ecc4d858b92c1bb0673ad9c327298e600c55659 (patch) | |
| tree | ad4cc5de86b1a3c6304cbc6d0053a2e49ddbcdf6 /scripts/lib/kdoc/kdoc_files.py | |
| parent | tcp_bpf: Fix copied value in tcp_bpf_sendmsg (diff) | |
| download | linux-rng-9ecc4d858b92c1bb0673ad9c327298e600c55659.tar.xz linux-rng-9ecc4d858b92c1bb0673ad9c327298e600c55659.zip | |
bpf: Check negative offsets in __bpf_skb_min_len()
skb_network_offset() and skb_transport_offset() can be negative when
they are called after we pull the transport header, for example, when
we use eBPF sockmap at the point of ->sk_data_ready().
__bpf_skb_min_len() uses an unsigned int to get these offsets, this
leads to a very large number which then causes bpf_skb_change_tail()
failed unexpectedly.
Fix this by using a signed int to get these offsets and ensure the
minimum is at least zero.
Fixes: 5293efe62df8 ("bpf: add bpf_skb_change_tail helper")
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20241213034057.246437-2-xiyou.wangcong@gmail.com
Diffstat (limited to 'scripts/lib/kdoc/kdoc_files.py')
0 files changed, 0 insertions, 0 deletions