diff options
| author | Sechang Lim <rhkrqnwk98@gmail.com> | 2026-06-20 02:44:16 +0000 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-06-25 17:42:02 -0700 |
| commit | 22a0cc10dacbafe1c28b6f513cc449cdd86d1cb1 (patch) | |
| tree | 9bf45f5782b31e0185bf1c62b18cdde9e711290c /rust/zerocopy/git@git.tavy.me:linux-stable.git | |
| parent | 4edcdefd4083ae04b1a5656f4be6cd83ae919ef4 (diff) | |
selftests/bpf: don't modify the skb in the strparser parser prog
sockmap_parse_prog.c is attached as an SK_SKB stream parser and modifies
the skb: it calls bpf_skb_pull_data() and writes a byte into the packet.
A stream parser runs on strparser's message head and must not modify it.
A resize frees the frag_list segments strparser still tracks, leading to
a use-after-free.
Make the parser read-only. It only needs to return the message length,
which keeps it attaching once packet-modifying parsers are rejected.
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
Link: https://lore.kernel.org/r/20260620024423.4141004-2-rhkrqnwk98@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'rust/zerocopy/git@git.tavy.me:linux-stable.git')
0 files changed, 0 insertions, 0 deletions
