From: Jeongjun Park <aha310510@xxxxxxxxx>
[ Upstream commit 9da49aa80d686582bc3a027112a30484c9be6b6e ]
There are cases where do_xdp_generic returns bpf_net_context without
clearing it. This causes various memory corruptions, so the missing
bpf_net_ctx_clear must be added.
Reported-by: syzbot+44623300f057a28baf1e@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: fecef4cd42c6 ("tun: Assign missing bpf_net_context.")
Signed-off-by: Jeongjun Park <aha310510@xxxxxxxxx>
Acked-by: Jason Wang <jasowang@xxxxxxxxxx>
Reviewed-by: Willem de Bruijn <willemb@xxxxxxxxxx>
Reported-by: syzbot+3c2b6d5d4bec3b904933@xxxxxxxxxxxxxxxxxxxxxxxxx
Reported-by: syzbot+707d98c8649695eaf329@xxxxxxxxxxxxxxxxxxxxxxxxx
Reported-by: syzbot+c226757eb784a9da3e8b@xxxxxxxxxxxxxxxxxxxxxxxxx
Reported-by: syzbot+61a1cfc2b6632363d319@xxxxxxxxxxxxxxxxxxxxxxxxx
Reported-by: syzbot+709e4c85c904bcd62735@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
[rcn: trivial backport edit to adapt the patch context.]
Signed-off-by: Ricardo Cañuelo Navarro <rcn@xxxxxxxxxx>
---
net/core/dev.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/core/dev.c b/net/core/dev.c
index a6a63f5b6b8364d2d24553180d4e2138b13614b9..3d1bf7be1ab1cc74f50a2e5b8bf05d21def3c5a2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5075,6 +5075,7 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff *skb)
bpf_net_ctx_clear(bpf_net_ctx);
return XDP_DROP;
}
+ bpf_net_ctx_clear(bpf_net_ctx);
}
return XDP_PASS;
out_redir:
--
2.48.1
