]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
selftests/bpf: don't modify the skb in the strparser parser prog
authorSechang Lim <rhkrqnwk98@gmail.com>
Sat, 20 Jun 2026 02:44:16 +0000 (02:44 +0000)
committerAlexei Starovoitov <ast@kernel.org>
Fri, 26 Jun 2026 00:42:02 +0000 (17:42 -0700)
commit22a0cc10dacbafe1c28b6f513cc449cdd86d1cb1
tree9bf45f5782b31e0185bf1c62b18cdde9e711290c
parent4edcdefd4083ae04b1a5656f4be6cd83ae919ef4
selftests/bpf: don't modify the skb in the strparser parser prog

sockmap_parse_prog.c is attached as an SK_SKB stream parser and modifies
the skb: it calls bpf_skb_pull_data() and writes a byte into the packet.
A stream parser runs on strparser's message head and must not modify it.
A resize frees the frag_list segments strparser still tracks, leading to
a use-after-free.

Make the parser read-only. It only needs to return the message length,
which keeps it attaching once packet-modifying parsers are rejected.

Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
Link: https://lore.kernel.org/r/20260620024423.4141004-2-rhkrqnwk98@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
tools/testing/selftests/bpf/progs/sockmap_parse_prog.c