Commit ce34e4b0 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Xiaomeng Zhang
Browse files

bpf: Remove MEM_UNINIT from skb/xdp MTU helpers 

stable inclusion
from stable-v6.6.59
commit d123062a3fdc57c931c57fb4606360b47d501ed0
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2SUA
CVE: CVE-2024-50164

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d123062a3fdc



--------------------------------

[ Upstream commit 14a3d3ef02ba53447d5112a2641aac0d10dc994f ]

We can now undo parts of 4b3786a6c539 ("bpf: Zero former ARG_PTR_TO_{LONG,INT}
args in case of error") as discussed in [0].

Given the BPF helpers now have MEM_WRITE tag, the MEM_UNINIT can be cleared.

The mtu_len is an input as well as output argument, meaning, the BPF program
has to set it to something. It cannot be uninitialized. Therefore, allowing
uninitialized memory and zeroing it on error would be odd. It was done as
an interim step in 4b3786a6c539 as the desired behavior could not have been
expressed before the introduction of MEM_WRITE tag.

Fixes: 4b3786a6c539 ("bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error")
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/a86eb76d-f52f-dee4-e5d2-87e45de3e16f@iogearbox.net

 [0]
Acked-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241021152809.33343-3-daniel@iogearbox.net


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarXiaomeng Zhang <zhangxiaomeng13@huawei.com>
parent db044923

net/core/filter.c

+15 −27
Original line number Diff line number Diff line
@@ -6289,24 +6289,16 @@ BPF_CALL_5(bpf_skb_check_mtu, struct sk_buff *, skb, 
{

	int ret = BPF_MTU_CHK_RET_FRAG_NEEDED;

	struct net_device *dev = skb->dev;

	int skb_len, dev_len;

	int mtu = 0;

	int mtu, dev_len, skb_len;



	if (unlikely(flags & ~(BPF_MTU_CHK_SEGS))) {

		ret = -EINVAL;

		goto out;

	}



	if (unlikely(flags & BPF_MTU_CHK_SEGS && (len_diff || *mtu_len))) {

		ret = -EINVAL;

		goto out;

	}

	if (unlikely(flags & ~(BPF_MTU_CHK_SEGS)))

		return -EINVAL;

	if (unlikely(flags & BPF_MTU_CHK_SEGS && (len_diff || *mtu_len)))

		return -EINVAL;



	dev = __dev_via_ifindex(dev, ifindex);

	if (unlikely(!dev)) {

		ret = -ENODEV;

		goto out;

	}

	if (unlikely(!dev))

		return -ENODEV;



	mtu = READ_ONCE(dev->mtu);

	dev_len = mtu + dev->hard_header_len;
@@ -6341,19 +6333,15 @@ BPF_CALL_5(bpf_xdp_check_mtu, struct xdp_buff *, xdp, 
	struct net_device *dev = xdp->rxq->dev;

	int xdp_len = xdp->data_end - xdp->data;

	int ret = BPF_MTU_CHK_RET_SUCCESS;

	int mtu = 0, dev_len;

	int mtu, dev_len;



	/* XDP variant doesn't support multi-buffer segment check (yet) */

	if (unlikely(flags)) {

		ret = -EINVAL;

		goto out;

	}

	if (unlikely(flags))

		return -EINVAL;



	dev = __dev_via_ifindex(dev, ifindex);

	if (unlikely(!dev)) {

		ret = -ENODEV;

		goto out;

	}

	if (unlikely(!dev))

		return -ENODEV;



	mtu = READ_ONCE(dev->mtu);

	dev_len = mtu + dev->hard_header_len;
@@ -6365,7 +6353,7 @@ BPF_CALL_5(bpf_xdp_check_mtu, struct xdp_buff *, xdp, 
	xdp_len += len_diff; /* minus result pass check */

	if (xdp_len > dev_len)

		ret = BPF_MTU_CHK_RET_FRAG_NEEDED;

out:



	*mtu_len = mtu;

	return ret;

}
@@ -6376,7 +6364,7 @@ static const struct bpf_func_proto bpf_skb_check_mtu_proto = { 
	.ret_type	= RET_INTEGER,

	.arg1_type      = ARG_PTR_TO_CTX,

	.arg2_type      = ARG_ANYTHING,

	.arg3_type      = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED,

	.arg3_type      = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_WRITE | MEM_ALIGNED,

	.arg3_size	= sizeof(u32),

	.arg4_type      = ARG_ANYTHING,

	.arg5_type      = ARG_ANYTHING,
@@ -6388,7 +6376,7 @@ static const struct bpf_func_proto bpf_xdp_check_mtu_proto = { 
	.ret_type	= RET_INTEGER,

	.arg1_type      = ARG_PTR_TO_CTX,

	.arg2_type      = ARG_ANYTHING,

	.arg3_type      = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED,

	.arg3_type      = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_WRITE | MEM_ALIGNED,

	.arg3_size	= sizeof(u32),

	.arg4_type      = ARG_ANYTHING,

	.arg5_type      = ARG_ANYTHING,