tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()

name2965 · davem330 · commit 9da49aa80d68 · 2024-07-29T10:55:15.000+01:00
There are cases where do_xdp_generic returns bpf_net_context without clearing it. This causes various memory corruptions, so the missing bpf_net_ctx_clear must be added. Reported-by: syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com Fixes: fecef4c ("tun: Assign missing bpf_net_context.") Signed-off-by: Jeongjun Park <aha310510@gmail.com> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Reported-by: syzbot+3c2b6d5d4bec3b904933@syzkaller.appspotmail.com Reported-by: syzbot+707d98c8649695eaf329@syzkaller.appspotmail.com Reported-by: syzbot+c226757eb784a9da3e8b@syzkaller.appspotmail.com Reported-by: syzbot+61a1cfc2b6632363d319@syzkaller.appspotmail.com Reported-by: syzbot+709e4c85c904bcd62735@syzkaller.appspotmail.com Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/net/core/dev.c b/net/core/dev.c
@@ -5150,6 +5150,7 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
 			bpf_net_ctx_clear(bpf_net_ctx);
 			return XDP_DROP;
 		}
+		bpf_net_ctx_clear(bpf_net_ctx);
 	}
 	return XDP_PASS;
 out_redir:

Original file line number	Diff line number	Diff line change
`@@ -5150,6 +5150,7 @@ int do_xdp_generic(struct bpf_prog xdp_prog, struct sk_buff *pskb)`
`5150`	`5150`	`bpf_net_ctx_clear(bpf_net_ctx);`
`5151`	`5151`	`return XDP_DROP;`
`5152`	`5152`	`}`
	`5153`	`+ bpf_net_ctx_clear(bpf_net_ctx);`
`5153`	`5154`	`}`
`5154`	`5155`	`return XDP_PASS;`
`5155`	`5156`	`out_redir:`