Commit 9b28ae24 authored May 21, 2019 by Lorenz Bauer Committed by Daniel Borkmann May 21, 2019

bpf: fix out-of-bounds read in __bpf_skc_lookup



__bpf_skc_lookup takes a socket tuple and the length of the
tuple as an argument. Based on the length, it decides which
address family to pass to the helper function sk_lookup.

In case of AF_INET6, it fails to verify that the length
of the tuple is long enough. sk_lookup may therefore access
data past the end of the tuple.

Fixes: 6acc9b43 ("bpf: Add helper to retrieve socket in BPF")
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

parent 221fb726

net/core/filter.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -5304,7 +5304,13 @@ __bpf_skc_lookup(struct sk_buff skb, struct bpf_sock_tuple tuple, u32 len,
		struct net *net;
		int sdif;

		family = len == sizeof(tuple->ipv4) ? AF_INET : AF_INET6;
		if (len == sizeof(tuple->ipv4))
		family = AF_INET;
		else if (len == sizeof(tuple->ipv6))
		family = AF_INET6;
		else
		return NULL;

		if (unlikely(family == AF_UNSPEC \|\| flags \|\|
		!((s32)netns_id < 0 \|\| netns_id <= S32_MAX)))
		goto out;

Admin message