CVE-2024-58237
bpf: consider that tail calls invalidate packet pointers
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
bpf: consider that tail calls invalidate packet pointers
In the Linux kernel, the following vulnerability has been resolved: bpf: consider that tail calls invalidate packet pointers Tail-called programs could execute any of the helpers that invalidate packet pointers. Hence, conservatively assume that each tail call invalidates packet pointers. Making the change in bpf_helper_changes_pkt_data() automatically makes use of check_cfg() logic that computes 'changes_pkt_data' effect for global sub-programs, such that the following program could be rejected: int tail_call(struct __sk_buff *sk) { bpf_tail_call_static(sk, &jmp_table, 0); return 0; } SEC("tc") int not_safe(struct __sk_buff *sk) { int *p = (void *)(long)sk->data; ... make p valid ... tail_call(sk); *p = 42; /* this is unsafe */ ... } The tc_bpf2bpf.c:subprog_tc() needs change: mark it as a function that can invalidate packet pointers. Otherwise, it can't be freplaced with tailcall_freplace.c:entry_freplace() that does a tail call.
Reserved 2025-04-16 | Published 2025-05-05 | Updated 2025-05-09 | Assigner Linuxgit.kernel.org/...c/f1692ee23dcaaddc24ba407b269707ee5df1301f
git.kernel.org/...c/1c2244437f9ad3dd91215f920401a14f2542dbfc
git.kernel.org/...c/1a4607ffba35bf2a630aab299e34dd3f6e658d70
Support options
