Messages in this thread | | | Date | Mon, 24 Jul 2023 15:15:07 -0700 | From | Jakub Kicinski <> | Subject | Re: [PATCH v1] bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing |
| |
On Sun, 23 Jul 2023 15:54:52 +0800 Lin Ma wrote: > diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c > index d4172534dfa8..6f1afbb394a6 100644 > --- a/net/core/bpf_sk_storage.c > +++ b/net/core/bpf_sk_storage.c > @@ -511,6 +511,11 @@ bpf_sk_storage_diag_alloc(const struct nlattr *nla_stgs) > if (nla_type(nla) != SK_DIAG_BPF_STORAGE_REQ_MAP_FD) > continue; > > + if (nla_len(nla) < sizeof(map_fd)) { > + err = -EINVAL; > + goto err_free; > + }
You can move this check earlier, when the attributes are getting counted. That way we can avoid the alloc/free on error.
| |