Re: [PATCH bpf 2/2] net/flow_dissector: correctly cap nhoff and thoff in case of BPF

On Wed, Dec 5, 2018 at 8:41 PM Stanislav Fomichev wrote: > > We want to make sure that the following condition holds: > 0 <= nhoff <= thoff <= skb->len > > BPF program can set out-of-bounds nhoff and thoff, which is dangerous, see > recent commit d0c081b49137 ("flow_dissector: properly cap thoff

[PATCH bpf 2/2] net/flow_dissector: correctly cap nhoff and thoff in case of BPF

We want to make sure that the following condition holds: 0 <= nhoff <= thoff <= skb->len BPF program can set out-of-bounds nhoff and thoff, which is dangerous, see recent commit d0c081b49137 ("flow_dissector: properly cap thoff field")'. Signed-off-by: Stanislav Fomichev ---