Commit ead3d7b2 authored by Paul Chaignon's avatar Paul Chaignon Committed by Alexei Starovoitov
Browse files

bpf: Check flow_dissector ctx accesses are aligned 



flow_dissector_is_valid_access doesn't check that the context access is
aligned. As a consequence, an unaligned access within one of the exposed
field is considered valid and later rejected by
flow_dissector_convert_ctx_access when we try to convert it.

The later rejection is problematic because it's reported as a verifier
bug with a kernel warning and doesn't point to the right instruction in
verifier logs.

Fixes: d58e468b ("flow_dissector: implements flow dissector BPF hook")
Reported-by: default avatar <syzbot+ccac90e482b2a81d74aa@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=ccac90e482b2a81d74aa


Signed-off-by: default avatarPaul Chaignon <paul.chaignon@gmail.com>
Acked-by: default avatarYonghong Song <yonghong.song@linux.dev>
Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/cc1b036be484c99be45eddf48bd78cc6f72839b1.1754039605.git.paul.chaignon@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 93acc0f4

net/core/filter.c

+3 −0
Original line number Diff line number Diff line
@@ -9458,6 +9458,9 @@ static bool flow_dissector_is_valid_access(int off, int size, 
	if (off < 0 || off >= sizeof(struct __sk_buff))

		return false;



	if (off % size != 0)

		return false;



	if (type == BPF_WRITE)

		return false;