Commit 9e6448f7 authored by Paul Chaignon's avatar Paul Chaignon Committed by Alexei Starovoitov
Browse files

bpf: Check netfilter ctx accesses are aligned 



Similarly to the previous patch fixing the flow_dissector ctx accesses,
nf_is_valid_access also doesn't check that ctx accesses are aligned.
Contrary to flow_dissector programs, netfilter programs don't have
context conversion. The unaligned ctx accesses are therefore allowed by
the verifier.

Fixes: fd9c663b ("bpf: minimal support for programs hooked into netfilter framework")
Signed-off-by: default avatarPaul Chaignon <paul.chaignon@gmail.com>
Acked-by: default avatarYonghong Song <yonghong.song@linux.dev>
Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/853ae9ed5edaa5196e8472ff0f1bb1cc24059214.1754039605.git.paul.chaignon@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent ead3d7b2

net/netfilter/nf_bpf_link.c

+3 −0
Original line number Diff line number Diff line
@@ -296,6 +296,9 @@ static bool nf_is_valid_access(int off, int size, enum bpf_access_type type, 
	if (off < 0 || off >= sizeof(struct bpf_nf_ctx))

		return false;



	if (off % size != 0)

		return false;



	if (type == BPF_WRITE)

		return false;