From: Jeongjun Park aha310510@gmail.com
[ Upstream commit 9da49aa80d686582bc3a027112a30484c9be6b6e ]
There are cases where do_xdp_generic returns bpf_net_context without clearing it. This causes various memory corruptions, so the missing bpf_net_ctx_clear must be added.
Reported-by: syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com Fixes: fecef4cd42c6 ("tun: Assign missing bpf_net_context.") Signed-off-by: Jeongjun Park aha310510@gmail.com Acked-by: Jason Wang jasowang@redhat.com Reviewed-by: Willem de Bruijn willemb@google.com Reported-by: syzbot+3c2b6d5d4bec3b904933@syzkaller.appspotmail.com Reported-by: syzbot+707d98c8649695eaf329@syzkaller.appspotmail.com Reported-by: syzbot+c226757eb784a9da3e8b@syzkaller.appspotmail.com Reported-by: syzbot+61a1cfc2b6632363d319@syzkaller.appspotmail.com Reported-by: syzbot+709e4c85c904bcd62735@syzkaller.appspotmail.com Signed-off-by: David S. Miller davem@davemloft.net [rcn: trivial backport edit to adapt the patch context.] Signed-off-by: Ricardo Cañuelo Navarro rcn@igalia.com --- net/core/dev.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/net/core/dev.c b/net/core/dev.c index a6a63f5b6b8364d2d24553180d4e2138b13614b9..3d1bf7be1ab1cc74f50a2e5b8bf05d21def3c5a2 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -5075,6 +5075,7 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff *skb) bpf_net_ctx_clear(bpf_net_ctx); return XDP_DROP; } + bpf_net_ctx_clear(bpf_net_ctx); } return XDP_PASS; out_redir: