summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStanislav Fomichev <sdf@google.com>2019-04-01 23:57:32 +0300
committerDaniel Borkmann <daniel@iogearbox.net>2019-04-03 17:49:48 +0300
commitb9e9c8599f0f23e3d2051befc9966a84b639f64f (patch)
treeb602fe9bf2d1826282b3a9467d401d41d3ae5c61
parent822fe61795018265ae14731d4e5399e5bde36864 (diff)
downloadlinux-b9e9c8599f0f23e3d2051befc9966a84b639f64f.tar.xz
flow_dissector: fix clamping of BPF flow_keys for non-zero nhoff
Don't allow BPF program to set flow_keys->nhoff to less than initial value. We currently don't read the value afterwards in anything but the tests, but it's still a good practice to return consistent values to the test programs. Signed-off-by: Stanislav Fomichev <sdf@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-rw-r--r--net/core/flow_dissector.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 9b84250039df..94a450b2191a 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -717,7 +717,8 @@ bool __skb_flow_bpf_dissect(struct bpf_prog *prog,
/* Restore state */
memcpy(cb, &cb_saved, sizeof(cb_saved));
- flow_keys->nhoff = clamp_t(u16, flow_keys->nhoff, 0, skb->len);
+ flow_keys->nhoff = clamp_t(u16, flow_keys->nhoff,
+ skb_network_offset(skb), skb->len);
flow_keys->thoff = clamp_t(u16, flow_keys->thoff,
flow_keys->nhoff, skb->len);