diff options
| author | Cong Wang <[email protected]> | 2024-12-13 03:40:54 +0000 |
|---|---|---|
| committer | Daniel Borkmann <[email protected]> | 2024-12-20 22:13:31 +0000 |
| commit | 9ecc4d858b92c1bb0673ad9c327298e600c55659 (patch) | |
| tree | ad4cc5de86b1a3c6304cbc6d0053a2e49ddbcdf6 /tools/testing/selftests/bpf/prog_tests/sockmap_basic.c | |
| parent | tcp_bpf: Fix copied value in tcp_bpf_sendmsg (diff) | |
| download | kernel-9ecc4d858b92c1bb0673ad9c327298e600c55659.tar.gz kernel-9ecc4d858b92c1bb0673ad9c327298e600c55659.zip | |
bpf: Check negative offsets in __bpf_skb_min_len()
skb_network_offset() and skb_transport_offset() can be negative when
they are called after we pull the transport header, for example, when
we use eBPF sockmap at the point of ->sk_data_ready().
__bpf_skb_min_len() uses an unsigned int to get these offsets, this
leads to a very large number which then causes bpf_skb_change_tail()
failed unexpectedly.
Fix this by using a signed int to get these offsets and ensure the
minimum is at least zero.
Fixes: 5293efe62df8 ("bpf: add bpf_skb_change_tail helper")
Signed-off-by: Cong Wang <[email protected]>
Signed-off-by: Daniel Borkmann <[email protected]>
Acked-by: John Fastabend <[email protected]>
Link: https://lore.kernel.org/bpf/[email protected]
Diffstat (limited to 'tools/testing/selftests/bpf/prog_tests/sockmap_basic.c')
0 files changed, 0 insertions, 0 deletions