Commit 12bec2bd authored by Sun Jian's avatar Sun Jian Committed by Alexei Starovoitov
Browse files

bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb 



bpf_prog_test_run_skb() calls eth_type_trans() first and then uses
skb->protocol to initialize sk family and address fields for the test
run.

For IPv4 and IPv6 packets, it may access ip_hdr(skb) or ipv6_hdr(skb)
even when the provided test input only contains an Ethernet header.

Reject the input earlier if the Ethernet frame carries IPv4/IPv6
EtherType but the L3 header is too short.

Fold the IPv4/IPv6 header length checks into the existing protocol
switch and return -EINVAL before accessing the network headers.

Fixes: fa5cb548 ("bpf: Setup socket family and addresses in bpf_prog_test_run_skb")
Reported-by: default avatar <syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=619b9ef527f510a57cfc


Signed-off-by: default avatarSun Jian <sun.jian.kdev@gmail.com>
Link: https://lore.kernel.org/r/20260408034623.180320-2-sun.jian.kdev@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 47687a29

net/bpf/test_run.c

+12 −8
Original line number Diff line number Diff line
@@ -1137,19 +1137,23 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, 


	switch (skb->protocol) {

	case htons(ETH_P_IP):

		if (skb_headlen(skb) < sizeof(struct iphdr)) {

			ret = -EINVAL;

			goto out;

		}

		sk->sk_family = AF_INET;

		if (sizeof(struct iphdr) <= skb_headlen(skb)) {

		sk->sk_rcv_saddr = ip_hdr(skb)->saddr;

		sk->sk_daddr = ip_hdr(skb)->daddr;

		}

		break;

#if IS_ENABLED(CONFIG_IPV6)

	case htons(ETH_P_IPV6):

		if (skb_headlen(skb) < sizeof(struct ipv6hdr)) {

			ret = -EINVAL;

			goto out;

		}

		sk->sk_family = AF_INET6;

		if (sizeof(struct ipv6hdr) <= skb_headlen(skb)) {

		sk->sk_v6_rcv_saddr = ipv6_hdr(skb)->saddr;

		sk->sk_v6_daddr = ipv6_hdr(skb)->daddr;

		}

		break;

#endif

	default: