Received: by 2002:a05:7412:419a:b0:f3:1519:9f41 with SMTP id i26csp4468012rdh; Wed, 29 Nov 2023 02:16:40 -0800 (PST) X-Google-Smtp-Source: AGHT+IEBmSbRT2gfWoQB06I8YYbw4XhQMFjbLKN2eLs24CLi6Vhe++d6FCIQFBtGa5p3bQiND72G X-Received: by 2002:a05:6830:4407:b0:6d3:3845:fa36 with SMTP id q7-20020a056830440700b006d33845fa36mr23215947otv.29.1701253000193; Wed, 29 Nov 2023 02:16:40 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1701253000; cv=none; d=google.com; s=arc-20160816; b=oiqwRhMBxTOt9fCDhqYTtlif/LF+UQEADKvM1yU3wcfh/3luYYTMmjC7PSPcusJsEd RL0U83WZQv48HTFSCeunZMrqyItTbb965y5WY3H7gJbKDKmSKLlxp8ILOLfxV/Txb9mb YyaFMkIHs2RUayN7AB7A7egDCLIZaiqqzGlW3WhJeUikYqZi1lV0FL17Ta/YB13eMJI0 5jGA5T8tVkpo1df4aNBcpRgNxpzRv14bRRWfMUR9lMyRARiHvRxOrnAwBx3sezD39u0R q88FNS+jTC7j3p9gdsw/qIJgsA9VSW+UB1cIby8Eu6izLNtNTGCFaBClbNwRDHnnPFLk RCIA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:message-id:date:subject:cc:to:from; bh=IaiguJmGzt8Qs2jOfeprncfmigP+u7Nx5h2rjrxtxNw=; fh=0j9hEtKEGSulx/lgeQcpDl+4ujiVFr5DCPGOZLIRfAc=; b=suSjX8krrZ7Rzzc6svT3bUh5bR6mR1rQfGoDyWXx47ittljwDCy56MKVXPDJY8e/kh K63lE6unQI7SfYXWj9HA8EfhvZS7YyWoYOo6eGJu74lQscx7mS9xLf6srnMyeJoW0hE3 NkZVpa+Bm2o8fzy2K87wfBLhtchL8V4jbqBhcJetvJsHgWH+G4BjkMzvJ3qNY6/dqZPE QH6++gcevuQIEWgcLMMCvAK3HPBP7kQoz0DsIeTM706QFuIfUY9FJB8Q/8+KxLpPiFjO qWC4qvQ47k8T9AOOCWLbb9cDur4azOMqdUyCTyxS0KYiuKiCrXQV02LvHPnzfFmIVU+N X6AQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Return-Path: Received: from agentk.vger.email (agentk.vger.email. [23.128.96.32]) by mx.google.com with ESMTPS id d35-20020a631d63000000b005c278de2066si14595746pgm.529.2023.11.29.02.16.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 29 Nov 2023 02:16:40 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) client-ip=23.128.96.32; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by agentk.vger.email (Postfix) with ESMTP id C03048046A37; Wed, 29 Nov 2023 02:16:37 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at agentk.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229848AbjK2KQG (ORCPT + 99 others); Wed, 29 Nov 2023 05:16:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48798 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229509AbjK2KQE (ORCPT ); Wed, 29 Nov 2023 05:16:04 -0500 Received: from out30-130.freemail.mail.aliyun.com (out30-130.freemail.mail.aliyun.com [115.124.30.130]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6696FC4; Wed, 29 Nov 2023 02:16:10 -0800 (PST) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R151e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018046050;MF=alibuda@linux.alibaba.com;NM=1;PH=DS;RN=13;SR=0;TI=SMTPD_---0VxNr3Ss_1701252962; Received: from j66a10360.sqa.eu95.tbsite.net(mailfrom:alibuda@linux.alibaba.com fp:SMTPD_---0VxNr3Ss_1701252962) by smtp.aliyun-inc.com; Wed, 29 Nov 2023 18:16:08 +0800 From: "D. Wythe" To: pablo@netfilter.org, kadlec@netfilter.org, fw@strlen.de Cc: bpf@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, coreteam@netfilter.org, netfilter-devel@vger.kernel.org, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, ast@kernel.org Subject: [PATCH net] net/netfilter: bpf: avoid leakage of skb Date: Wed, 29 Nov 2023 18:16:02 +0800 Message-Id: <1701252962-63418-1-git-send-email-alibuda@linux.alibaba.com> X-Mailer: git-send-email 1.8.3.1 X-Spam-Status: No, score=-0.8 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE, UNPARSEABLE_RELAY autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on agentk.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (agentk.vger.email [0.0.0.0]); Wed, 29 Nov 2023 02:16:37 -0800 (PST) From: "D. Wythe" A malicious eBPF program can interrupt the subsequent processing of a skb by returning an exceptional retval, and no one will be responsible for releasing the very skb. Moreover, normal programs can also have the demand to return NF_STOLEN, usually, the hook needs to take responsibility for releasing this skb itself, but currently, there is no such helper function to achieve that. Ignoring NF_STOLEN will also lead to skb leakage. Fixes: fd9c663b9ad6 ("bpf: minimal support for programs hooked into netfilter framework") Signed-off-by: D. Wythe --- net/netfilter/nf_bpf_link.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_bpf_link.c b/net/netfilter/nf_bpf_link.c index e502ec0..03c47d6 100644 --- a/net/netfilter/nf_bpf_link.c +++ b/net/netfilter/nf_bpf_link.c @@ -12,12 +12,29 @@ static unsigned int nf_hook_run_bpf(void *bpf_prog, struct sk_buff *skb, const struct nf_hook_state *s) { const struct bpf_prog *prog = bpf_prog; + unsigned int verdict; struct bpf_nf_ctx ctx = { .state = s, .skb = skb, }; - return bpf_prog_run(prog, &ctx); + verdict = bpf_prog_run(prog, &ctx); + switch (verdict) { + case NF_STOLEN: + consume_skb(skb); + fallthrough; + case NF_ACCEPT: + case NF_DROP: + case NF_QUEUE: + /* restrict the retval of the ebpf programs */ + break; + default: + /* force it to be dropped */ + verdict = NF_DROP_ERR(-EINVAL); + break; + } + + return verdict; } struct bpf_nf_link { -- 1.8.3.1