diff options
| author | Weiming Shi <bestswngs@gmail.com> | 2026-09-09 12:08:08 +0800 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2026-09-09 20:35:42 +0200 |
| commit | e4a62833adff6ef0fe7c0b90393204fe3c26b5c5 (patch) | |
| tree | f8f5e86302c7e7809fb1cb798cc182d77d88d760 /include/linux | |
| parent | 15e2565f1c43771af0bc5324971cabaad79ac286 (diff) | |
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
An LWT_SEG6LOCAL program can invalidate its cached SRH with
bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter
may reallocate skb->head, leaving the per-CPU SRH pointer dangling.
Post-program SRH validation then writes through that pointer.
Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier
rejects this unsafe helper combination. Other LWT program types continue
to expose the helper through lwt_out_func_proto().
Fixes: 004d4b274e2a ("ipv6: sr: Add seg6local action End.BPF")
Reported-by: co+adfca3e91be95776@bugs.sh
Suggested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Closes: https://lore.kernel.org/all/GCy0KRM2IcQGoJQTjJEU9D0maBxXzEDHuQpq@bugs.sh/
Link: https://lore.kernel.org/bpf/DL9COXZQXX4V.1FN45QO2Q77ZH@gmail.com/
Link: https://lore.kernel.org/bpf/20260909040807.3885815-2-bestswngs@gmail.com
Diffstat (limited to 'include/linux')
0 files changed, 0 insertions, 0 deletions