mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-04 02:30:34 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

bpf: reserve xdp_frame size in xdp headroom

Browse source 
Commit 6dfb970d3d ("xdp: avoid leaking info stored in frame data on
page reuse") tried to allow user/bpf_prog to (re)use area used by
xdp_frame (stored in frame headroom), by memset clearing area when
bpf_xdp_adjust_head give bpf_prog access to headroom area.

The mentioned commit had two bugs. (1) Didn't take bpf_xdp_adjust_meta
into account. (2) a combination of bpf_xdp_adjust_head calls, where
xdp->data is moved into xdp_frame section, can cause clearing
xdp_frame area again for area previously granted to bpf_prog.

After discussions with Daniel, we choose to implement a simpler
solution to the problem, which is to reserve the headroom used by
xdp_frame info.

This also avoids the situation where bpf_prog is allowed to adjust/add
headers, and then XDP_REDIRECT later drops the packet due to lack of
headroom for the xdp_frame.  This would likely confuse the end-user.

Fixes: 6dfb970d3d ("xdp: avoid leaking info stored in frame data on page reuse")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
This commit is contained in:
Jesper Dangaard Brouer 2018-04-19 16:17:12 +02:00 committed by Daniel Borkmann
parent 7f3249fb12
commit 97e19cce05
1 changed files with 3 additions and 9 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

12
net/core/filter.c
View file

@ -2694,20 +2694,13 @@ BPF_CALL_2(bpf_xdp_adjust_head, struct xdp_buff *, xdp, int, offset)
{ {
void *xdp_frame_end = xdp->data_hard_start + sizeof(struct xdp_frame); void *xdp_frame_end = xdp->data_hard_start + sizeof(struct xdp_frame);
unsigned long metalen = xdp_get_metalen(xdp); unsigned long metalen = xdp_get_metalen(xdp);
void *data_start = xdp->data_hard_start + metalen; void *data_start = xdp_frame_end + metalen;
void *data = xdp->data + offset; void *data = xdp->data + offset;
if (unlikely(data < data_start || if (unlikely(data < data_start ||
data > xdp->data_end - ETH_HLEN)) data > xdp->data_end - ETH_HLEN))
return -EINVAL; return -EINVAL;
/* Avoid info leak, when reusing area prev used by xdp_frame */
if (data < xdp_frame_end) {
unsigned long clearlen = xdp_frame_end - data;
memset(data, 0, clearlen);
}
if (metalen) if (metalen)
memmove(xdp->data_meta + offset, memmove(xdp->data_meta + offset,
xdp->data_meta, metalen); xdp->data_meta, metalen);
@ -2751,12 +2744,13 @@ static const struct bpf_func_proto bpf_xdp_adjust_tail_proto = {
BPF_CALL_2(bpf_xdp_adjust_meta, struct xdp_buff *, xdp, int, offset) BPF_CALL_2(bpf_xdp_adjust_meta, struct xdp_buff *, xdp, int, offset)
{ {
void *xdp_frame_end = xdp->data_hard_start + sizeof(struct xdp_frame);
void *meta = xdp->data_meta + offset; void *meta = xdp->data_meta + offset;
unsigned long metalen = xdp->data - meta; unsigned long metalen = xdp->data - meta;
if (xdp_data_meta_unsupported(xdp)) if (xdp_data_meta_unsupported(xdp))
return -ENOTSUPP; return -ENOTSUPP;
if (unlikely(meta < xdp->data_hard_start || if (unlikely(meta < xdp_frame_end ||
meta > xdp->data)) meta > xdp->data))
return -EINVAL; return -EINVAL;
if (unlikely((metalen & (sizeof(__u32) - 1)) || if (unlikely((metalen & (sizeof(__u32) - 1)) ||