From: Jeongjun Park <aha310510@xxxxxxxxx>
[ Upstream commit 9da49aa80d686582bc3a027112a30484c9be6b6e ]
There are cases where do_xdp_generic returns bpf_net_context without
clearing it. This causes various memory corruptions, so the missing
bpf_net_ctx_clear must be added.
Reported-by: syzbot+44623300f057a28baf1e@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: fecef4cd42c6 ("tun: Assign missing bpf_net_context.")
Signed-off-by: Jeongjun Park <aha310510@xxxxxxxxx>
Acked-by: Jason Wang <jasowang@xxxxxxxxxx>
Reviewed-by: Willem de Bruijn <willemb@xxxxxxxxxx>
Reported-by: syzbot+3c2b6d5d4bec3b904933@xxxxxxxxxxxxxxxxxxxxxxxxx
Reported-by: syzbot+707d98c8649695eaf329@xxxxxxxxxxxxxxxxxxxxxxxxx
Reported-by: syzbot+c226757eb784a9da3e8b@xxxxxxxxxxxxxxxxxxxxxxxxx
Reported-by: syzbot+61a1cfc2b6632363d319@xxxxxxxxxxxxxxxxxxxxxxxxx
Reported-by: syzbot+709e4c85c904bcd62735@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
[rcn: trivial backport edit to adapt the patch context.]
Signed-off-by: Ricardo Cañuelo Navarro <rcn@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/core/dev.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5106,6 +5106,7 @@ int do_xdp_generic(struct bpf_prog *xdp_
bpf_net_ctx_clear(bpf_net_ctx);
return XDP_DROP;
}
+ bpf_net_ctx_clear(bpf_net_ctx);
}
return XDP_PASS;
out_redir:
Patches currently in stable-queue which might be from rcn@xxxxxxxxxx are
queue-6.6/tun-assign-missing-bpf_net_context.patch
queue-6.6/tun-add-missing-bpf_net_ctx_clear-in-do_xdp_generic.patch
queue-6.6/net-reference-bpf_redirect_info-via-task_struct-on-preempt_rt.patch
