]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
bpf: Check netfilter ctx accesses are aligned
authorPaul Chaignon <paul.chaignon@gmail.com>
Fri, 1 Aug 2025 09:48:15 +0000 (11:48 +0200)
committerAlexei Starovoitov <ast@kernel.org>
Fri, 1 Aug 2025 16:22:44 +0000 (09:22 -0700)
commit9e6448f7b1efb27f8d508b067ecd33ed664a4246
treea18226d02e40d0e1ccd0c10282e2f694844cdf3a
parentead3d7b2b6afa5ee7958620c4329982a7d9c2b78
bpf: Check netfilter ctx accesses are aligned

Similarly to the previous patch fixing the flow_dissector ctx accesses,
nf_is_valid_access also doesn't check that ctx accesses are aligned.
Contrary to flow_dissector programs, netfilter programs don't have
context conversion. The unaligned ctx accesses are therefore allowed by
the verifier.

Fixes: fd9c663b9ad6 ("bpf: minimal support for programs hooked into netfilter framework")
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/853ae9ed5edaa5196e8472ff0f1bb1cc24059214.1754039605.git.paul.chaignon@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
net/netfilter/nf_bpf_link.c