summaryrefslogtreecommitdiffstats
path: root/net/core
diff options
context:
space:
mode:
authorDaniel Borkmann <daniel@iogearbox.net>2017-01-24 01:06:26 +0100
committerDavid S. Miller <davem@davemloft.net>2017-01-24 14:46:05 -0500
commit4faf940dd869c36436ff6f0a0b20369fdf5da68b (patch)
tree32530874eaca2c6d4678ee0bb8f82b1fc6f429ec /net/core
parent187024144c6e0c82bc32ebb46f3cd0585264833e (diff)
downloadlinux-4faf940dd869c36436ff6f0a0b20369fdf5da68b.tar.bz2
bpf: simplify __is_valid_access test on cb
The __is_valid_access() test for cb[] from 62c7989b24db ("bpf: allow b/h/w/dw access for bpf's cb in ctx") was done unnecessarily complex, we can just simplify it the same way as recent fix from 2d071c643f1c ("bpf, trace: make ctx access checks more robust") did. Overflow can never happen as size is 1/2/4/8 depending on access. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
-rw-r--r--net/core/filter.c15
1 files changed, 2 insertions, 13 deletions
diff --git a/net/core/filter.c b/net/core/filter.c
index 90383860e224..883975fa4ed1 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2784,19 +2784,8 @@ static bool __is_valid_access(int off, int size)
switch (off) {
case offsetof(struct __sk_buff, cb[0]) ...
offsetof(struct __sk_buff, cb[4]) + sizeof(__u32) - 1:
- if (size == sizeof(__u16) &&
- off > offsetof(struct __sk_buff, cb[4]) + sizeof(__u16))
- return false;
- if (size == sizeof(__u32) &&
- off > offsetof(struct __sk_buff, cb[4]))
- return false;
- if (size == sizeof(__u64) &&
- off > offsetof(struct __sk_buff, cb[2]))
- return false;
- if (size != sizeof(__u8) &&
- size != sizeof(__u16) &&
- size != sizeof(__u32) &&
- size != sizeof(__u64))
+ if (off + size >
+ offsetof(struct __sk_buff, cb[4]) + sizeof(__u32))
return false;
break;
default: