Commit bbd52178 authored by Joanne Koong's avatar Joanne Koong Committed by Daniel Borkmann
Browse files

bpf: Fix bpf_xdp_pointer return pointer 



For the case where offset + len == size, bpf_xdp_pointer should return a
valid pointer to the addr because that access is permitted. We should
only return NULL in the case where offset + len exceeds size.

Fixes: 3f364222 ("net: xdp: introduce bpf_xdp_pointer utility routine")
Signed-off-by: default avatarJoanne Koong <joannelkoong@gmail.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
Acked-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/bpf/20220722220105.2065466-1-joannelkoong@gmail.com
parent 1115169f

net/core/filter.c

+1 −1
Original line number Diff line number Diff line
@@ -3918,7 +3918,7 @@ static void *bpf_xdp_pointer(struct xdp_buff *xdp, u32 offset, u32 len) 
		offset -= frag_size;

	}

out:

	return offset + len < size ? addr + offset : NULL;

	return offset + len <= size ? addr + offset : NULL;

}



BPF_CALL_4(bpf_xdp_load_bytes, struct xdp_buff *, xdp, u32, offset,