diff options
| -rw-r--r-- | kernel/bpf/verifier.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 3bc1df7aabe2..63fff641d985 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -9687,6 +9687,16 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, u32 slot, u32 p if (err) return err; + /* + * A slice of a packet is packet data under another name. A helper which + * may reallocate the packet must not go on reading from the old one. + */ + if (is_helper(meta) && reg_is_dynptr_slice_pkt(reg) && + bpf_helper_changes_pkt_data(meta->func_id)) { + verbose(env, "function access to the packet is not allowed\n"); + return -EACCES; + } + if (arg_type_is_raw_mem(arg_type)) meta->arg_raw_mem.mask |= BIT(slot); |