Commit 9da49aa8 authored by Jeongjun Park's avatar Jeongjun Park Committed by David S. Miller

tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()

There are cases where do_xdp_generic returns bpf_net_context without
clearing it. This causes various memory corruptions, so the missing
bpf_net_ctx_clear must be added.

Reported-by: syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com
Fixes: fecef4cd ("tun: Assign missing bpf_net_context.")
Signed-off-by: default avatarJeongjun Park <aha310510@gmail.com>
Acked-by: default avatarJason Wang <jasowang@redhat.com>
Reviewed-by: default avatarWillem de Bruijn <willemb@google.com>
Reported-by: syzbot+3c2b6d5d4bec3b904933@syzkaller.appspotmail.com
Reported-by: syzbot+707d98c8649695eaf329@syzkaller.appspotmail.com
Reported-by: syzbot+c226757eb784a9da3e8b@syzkaller.appspotmail.com
Reported-by: syzbot+61a1cfc2b6632363d319@syzkaller.appspotmail.com
Reported-by: syzbot+709e4c85c904bcd62735@syzkaller.appspotmail.com
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 301927d2
...@@ -5150,6 +5150,7 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb) ...@@ -5150,6 +5150,7 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
bpf_net_ctx_clear(bpf_net_ctx); bpf_net_ctx_clear(bpf_net_ctx);
return XDP_DROP; return XDP_DROP;
} }
bpf_net_ctx_clear(bpf_net_ctx);
} }
return XDP_PASS; return XDP_PASS;
out_redir: out_redir:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment