diff options
| author | Daniel Borkmann <daniel@iogearbox.net> | 2017-01-24 01:06:26 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-01-24 14:46:05 -0500 |
| commit | 4faf940dd869c36436ff6f0a0b20369fdf5da68b (patch) | |
| tree | 32530874eaca2c6d4678ee0bb8f82b1fc6f429ec | |
| parent | 187024144c6e0c82bc32ebb46f3cd0585264833e (diff) | |
| download | linux-4faf940dd869c36436ff6f0a0b20369fdf5da68b.tar.bz2 | |
bpf: simplify __is_valid_access test on cb
The __is_valid_access() test for cb[] from 62c7989b24db ("bpf: allow
b/h/w/dw access for bpf's cb in ctx") was done unnecessarily complex,
we can just simplify it the same way as recent fix from 2d071c643f1c
("bpf, trace: make ctx access checks more robust") did. Overflow can
never happen as size is 1/2/4/8 depending on access.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/core/filter.c | 15 |
1 files changed, 2 insertions, 13 deletions
diff --git a/net/core/filter.c b/net/core/filter.c index 90383860e224..883975fa4ed1 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2784,19 +2784,8 @@ static bool __is_valid_access(int off, int size) switch (off) { case offsetof(struct __sk_buff, cb[0]) ... offsetof(struct __sk_buff, cb[4]) + sizeof(__u32) - 1: - if (size == sizeof(__u16) && - off > offsetof(struct __sk_buff, cb[4]) + sizeof(__u16)) - return false; - if (size == sizeof(__u32) && - off > offsetof(struct __sk_buff, cb[4])) - return false; - if (size == sizeof(__u64) && - off > offsetof(struct __sk_buff, cb[2])) - return false; - if (size != sizeof(__u8) && - size != sizeof(__u16) && - size != sizeof(__u32) && - size != sizeof(__u64)) + if (off + size > + offsetof(struct __sk_buff, cb[4]) + sizeof(__u32)) return false; break; default: |