bpf: fix cg_skb types to hint access type in may_access_direct_pkt_data
authorDaniel Borkmann <daniel@iogearbox.net>
Wed, 24 Oct 2018 20:05:46 +0000 (22:05 +0200)
committerAlexei Starovoitov <ast@kernel.org>
Fri, 26 Oct 2018 00:02:06 +0000 (17:02 -0700)
commitd5563d367c2ce48ea3d675c77f7109f37311943d
treee0e5d11319f153c2d31379f5c080f5d71dee35b2
parent5d66fa7d9e9e9399ddfdc530f352dd6f7c724485
bpf: fix cg_skb types to hint access type in may_access_direct_pkt_data

Commit b39b5f411dcf ("bpf: add cg_skb_is_valid_access for
BPF_PROG_TYPE_CGROUP_SKB") added direct packet access for skbs in
cg_skb program types, however allowed access type was not added to
the may_access_direct_pkt_data() helper. Therefore the latter always
returns false. This is not directly an issue, it just means writes
are unconditionally disabled (which is correct) but also reads.
Latter is relevant in this function when BPF helpers may read direct
packet data which is unconditionally disabled then. Fix it by properly
adding BPF_PROG_TYPE_CGROUP_SKB to may_access_direct_pkt_data().

Fixes: b39b5f411dcf ("bpf: add cg_skb_is_valid_access for BPF_PROG_TYPE_CGROUP_SKB")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Cc: Song Liu <songliubraving@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/verifier.c