Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
From:   Lorenz Bauer <lmb@cloudflare.com>
Date:   Wed, 4 Apr 2018 11:04:08 +0200
Message-ID: <CACAyw9-TvamC2HMNv=WDk_aeAM=R7J_BgLiKjevY5+am71W6-A@mail.gmail.com>
Subject: PROBLEM: Using BPF_PROG_TEST_RUN with data_out != NULL is unsafe
To:     ast@kernel.org, daniel@iogearbox.net
Cc:     netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hello,

I=E2=80=99ve encountered an issue when using BPF_PROG_TEST_RUN and capturin=
g the output.
The kernel copies data into user space without checking the length of
the destination buffer.

In bpf_test_finish(), size is the amount of data in the XDP buffer /
skb after the program is run. This can be larger than data_size_in due
to bpf_xdp_adjust_head() and friends.
bpf_test_finish doesn=E2=80=99t clamp size to data_size_out, which is what =
I
was expecting.

What is the correct way to use this interface?

Best,
Lorenz

--=20
Lorenz Bauer  |  Systems Engineer
25 Lavington St., London SE1 0NZ

www.cloudflare.com