Commit 60ce37b0 authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

bpf, sockmap: Do not ignore orig_len parameter 



Currently, sk_psock_verdict_recv() returns skb->len

This is problematic because tcp_read_sock() might have
passed orig_len < skb->len, due to the presence of TCP urgent data.

This causes an infinite loop from tcp_read_sock()

Followup patch will make tcp_read_sock() more robust vs bad actors.

Fixes: ef565928 ("bpf, sockmap: Allow skipping sk_skb parser program")
Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Acked-by: default avatarJakub Sitnicki <jakub@cloudflare.com>
Tested-by: default avatarJakub Sitnicki <jakub@cloudflare.com>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20220302161723.3910001-1-eric.dumazet@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 1dba41c9

net/core/skmsg.c

+1 −1
Original line number Diff line number Diff line
@@ -1153,7 +1153,7 @@ static int sk_psock_verdict_recv(read_descriptor_t *desc, struct sk_buff *skb, 
	struct sk_psock *psock;

	struct bpf_prog *prog;

	int ret = __SK_DROP;

	int len = skb->len;

	int len = orig_len;



	/* clone here so sk_eat_skb() in tcp_read_sock does not drop our data */

	skb = skb_clone(skb, GFP_ATOMIC);