This is a note to let you know that I've just added the patch titled
bpf: Fix bpf_xdp_pointer return pointer
to the 5.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
bpf-fix-bpf_xdp_pointer-return-pointer.patch
and it can be found in the queue-5.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit c8a1ad90b0b6def1fa1fec9486c81ba527ae0469
Author: Joanne Koong <joannelkoong@xxxxxxxxx>
Date: Fri Jul 22 15:01:05 2022 -0700
bpf: Fix bpf_xdp_pointer return pointer
[ Upstream commit bbd52178e249fe893ef4a9b87cde5b6c473b0a7c ]
For the case where offset + len == size, bpf_xdp_pointer should return a
valid pointer to the addr because that access is permitted. We should
only return NULL in the case where offset + len exceeds size.
Fixes: 3f364222d032 ("net: xdp: introduce bpf_xdp_pointer utility routine")
Signed-off-by: Joanne Koong <joannelkoong@xxxxxxxxx>
Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
Acked-by: Martin KaFai Lau <kafai@xxxxxx>
Acked-by: Lorenzo Bianconi <lorenzo@xxxxxxxxxx>
Link: https://lore.kernel.org/bpf/20220722220105.2065466-1-joannelkoong@xxxxxxxxx
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/net/core/filter.c b/net/core/filter.c
index 5978984b752f..74f05ed6aff2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3918,7 +3918,7 @@ static void *bpf_xdp_pointer(struct xdp_buff *xdp, u32 offset, u32 len)
offset -= frag_size;
}
out:
- return offset + len < size ? addr + offset : NULL;
+ return offset + len <= size ? addr + offset : NULL;
}
BPF_CALL_4(bpf_xdp_load_bytes, struct xdp_buff *, xdp, u32, offset,
