Commit b9e9c859 authored by Stanislav Fomichev's avatar Stanislav Fomichev Committed by Daniel Borkmann
Browse files

flow_dissector: fix clamping of BPF flow_keys for non-zero nhoff 



Don't allow BPF program to set flow_keys->nhoff to less than initial
value. We currently don't read the value afterwards in anything but
the tests, but it's still a good practice to return consistent
values to the test programs.

Signed-off-by: default avatarStanislav Fomichev <sdf@google.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent 822fe617

net/core/flow_dissector.c

+2 −1
Original line number Diff line number Diff line
@@ -717,7 +717,8 @@ bool __skb_flow_bpf_dissect(struct bpf_prog *prog, 
	/* Restore state */

	memcpy(cb, &cb_saved, sizeof(cb_saved));



	flow_keys->nhoff = clamp_t(u16, flow_keys->nhoff, 0, skb->len);

	flow_keys->nhoff = clamp_t(u16, flow_keys->nhoff,

				   skb_network_offset(skb), skb->len);

	flow_keys->thoff = clamp_t(u16, flow_keys->thoff,

				   flow_keys->nhoff, skb->len);