Daniel Borkmann 0ed661d5a4 bpf: fix write helpers with regards to non-linear parts ... Fix the bpf_try_make_writable() helper and all call sites we have in BPF, it's currently defect with regards to skbs when the write_len spans into non-linear parts, no matter if cloned or not. There are multiple issues at once. First, using skb_store_bits() is not correct since even if we have a cloned skb, page frags can still be shared. To really make them private, we need to pull them in via __pskb_pull_tail() first, which also gets us a private head via pskb_expand_head() implicitly. This is for helpers like bpf_skb_store_bytes(), bpf_l3_csum_replace(), bpf_l4_csum_replace(). Really, the only thing reasonable and working here is to call skb_ensure_writable() before any write operation. Meaning, via pskb_may_pull() it makes sure that parts we want to access are pulled in and if not does so plus unclones the skb implicitly. If our write_len still fits the headlen and we're cloned and our header of the clone is not writable, then we need to make a private copy via pskb_expand_head(). skb_store_bits() is a bit misleading and only safe to store into non-linear data in different contexts such as 357b40a18b ("[IPV6]: IPV6_CHECKSUM socket option can corrupt kernel memory"). For above BPF helper functions, it means after fixed bpf_try_make_writable(), we've pulled in enough, so that we operate always based on skb->data. Thus, the call to skb_header_pointer() and skb_store_bits() becomes superfluous. In bpf_skb_store_bytes(), the len check is unnecessary too since it can only pass in maximum of BPF stack size, so adding offset is guaranteed to never overflow. Also bpf_l3/4_csum_replace() helpers must test for proper offset alignment since they use __sum16 pointer for writing resulting csum. The remaining helpers that change skb data not discussed here yet are bpf_skb_vlan_push(), bpf_skb_vlan_pop() and bpf_skb_change_proto(). The vlan helpers internally call either skb_ensure_writable() (pop case) and skb_cow_head() (push case, for head expansion), respectively. Similarly, bpf_skb_proto_xlat() takes care to not mangle page frags. Fixes: 608cd71a9c ("tc: bpf: generalize pedit action") Fixes: 91bc4822c3 ("tc: bpf: add checksum helpers") Fixes: 3697649ff2 ("bpf: try harder on clones when writing into skb") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-08-13 15:01:02 -07:00
..
datagram.c	udp: enable MSG_PEEK at non-zero offset	2016-04-05 16:29:37 -04:00
dev.c	Merge branch 'salted-string-hash'	2016-07-28 12:26:31 -07:00
dev_addr_lists.c
dev_ioctl.c
devlink.c	devlink: add hardware messages tracing facility	2016-07-12 14:20:18 -07:00
drop_monitor.c	net: tracepoint napi:napi_poll add work and budget	2016-07-09 18:05:02 -04:00
dst.c	net: add dst_cache to ovs vxlan lwtunnel	2016-02-16 20:21:48 -05:00
dst_cache.c	net: dst_cache_per_cpu_dst_set() can be static	2016-03-18 17:45:08 -04:00
ethtool.c	sctp: Add GSO support	2016-06-03 19:37:21 -04:00
fib_rules.c	fib_rules: Added NLM_F_EXCL support to fib_nl_newrule	2016-06-30 08:23:19 -04:00
filter.c	bpf: fix write helpers with regards to non-linear parts	2016-08-13 15:01:02 -07:00
flow.c	flowcache: Avoid OOM condition under preasure	2016-03-17 10:28:42 +01:00
flow_dissector.c	packet: Use symmetric hash for PACKET_FANOUT_HASH.	2016-07-01 16:07:50 -04:00
gen_estimator.c	net: sched: do not acquire qdisc spinlock in qdisc/class stats dump	2016-06-07 16:37:14 -07:00
gen_stats.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-06-10 11:52:24 -07:00
hwbm.c	net: hwbm: Fix unbalanced spinlock in error case	2016-05-25 12:35:09 -07:00
link_watch.c
lwtunnel.c	lwtunnel: autoload of lwt modules	2016-02-21 22:00:28 -05:00
Makefile	net: add a hardware buffer management helper API	2016-03-14 12:19:46 -04:00
neighbour.c	net: neigh: disallow transition to NUD_STALE if lladdr is unchanged in neigh_update()	2016-07-26 14:25:20 -07:00
net-procfs.c	net: remove NETDEV_TX_LOCKED support	2016-04-26 15:53:05 -04:00
net-sysfs.c	net: introduce NETDEV_CHANGE_TX_QUEUE_LEN	2016-07-01 05:32:17 -04:00
net-sysfs.h
net-traces.c	net: IPv6 fib lookup tracepoint	2015-11-22 11:54:10 -05:00
net_namespace.c
netclassid_cgroup.c	core: remove unneded headers for net cgroup controllers.	2016-02-17 15:31:27 -05:00
netevent.c
netpoll.c	net: tracepoint napi:napi_poll add work and budget	2016-07-09 18:05:02 -04:00
netprio_cgroup.c	core: remove unneded headers for net cgroup controllers.	2016-02-17 15:31:27 -05:00
pktgen.c	net: pktgen: support injecting packets for qdisc testing	2016-07-04 16:07:34 -07:00
ptp_classifier.c	ptp: Change ptp_class to a proper bitmask	2015-11-03 11:08:22 -05:00
request_sock.c	tcp: restore fastopen operations	2015-10-05 03:19:06 -07:00
rtnetlink.c	rtnl: protect do_setlink from IFLA_XDP_ATTACHED	2016-07-20 22:07:23 -07:00
scm.c	unix: correctly track in-flight fds in sending process user_struct	2016-02-08 10:30:42 -05:00
secure_seq.c
skbuff.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-07-06 10:35:22 -07:00
sock.c	dccp: limit sk_filter trim to payload	2016-07-13 11:53:41 -07:00
sock_diag.c	sock_diag: align nlattr properly when needed	2016-04-26 12:00:48 -04:00
sock_reuseport.c	soreuseport: fix NULL ptr dereference SO_REUSEPORT after bind	2016-01-19 14:44:23 -05:00
stream.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-12-03 21:09:12 -05:00
sysctl_net_core.c	bpf: add generic constant blinding for use in jits	2016-05-16 13:49:32 -04:00
timestamping.c	net: skb_defer_rx_timestamp should check for phydev before setting up classify	2015-07-09 14:17:15 -07:00
tso.c	net: tso: add support for IPv6	2015-10-26 22:24:22 -07:00
utils.c	net: the space is required before the open parenthesis '('	2016-06-29 05:15:14 -04:00