From bbd52178e249fe893ef4a9b87cde5b6c473b0a7c Mon Sep 17 00:00:00 2001 From: Joanne Koong Date: Fri, 22 Jul 2022 15:01:05 -0700 Subject: [PATCH] bpf: Fix bpf_xdp_pointer return pointer For the case where offset + len == size, bpf_xdp_pointer should return a valid pointer to the addr because that access is permitted. We should only return NULL in the case where offset + len exceeds size. Fixes: 3f364222d032 ("net: xdp: introduce bpf_xdp_pointer utility routine") Signed-off-by: Joanne Koong Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Acked-by: Lorenzo Bianconi Link: https://lore.kernel.org/bpf/20220722220105.2065466-1-joannelkoong@gmail.com --- net/core/filter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index dffc7dcda96a..5669248aff25 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -3918,7 +3918,7 @@ static void *bpf_xdp_pointer(struct xdp_buff *xdp, u32 offset, u32 len) offset -= frag_size; } out: - return offset + len < size ? addr + offset : NULL; + return offset + len <= size ? addr + offset : NULL; } BPF_CALL_4(bpf_xdp_load_bytes, struct xdp_buff *, xdp, u32, offset,