netdev - Re: [PATCH net-next 1/6] bpf: Fix tcp_synrto

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <9512ac76-7ebd-433d-5854-13e4812f64fc@iogearbox.net>
Date:   Fri, 10 Nov 2017 22:18:51 +0100
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Lawrence Brakmo <brakmo@...com>, netdev <netdev@...r.kernel.org>
Cc:     Alexei Starovoitov <ast@...com>
Subject: Re: [PATCH net-next 1/6] bpf: Fix tcp_synrto_kern.c sample program

On 11/10/2017 09:42 PM, Lawrence Brakmo wrote:
> The program was returning -1 in some cases which is not allowed
> by the verifier any longer.
> 
> Fixes: 8550f328f45d ("bpf: Support for per connection SYN/SYN-ACK RTOs")

Hmm, for most of the series (if not all), I think Fixes tag is:
390ee7e29fc8 ("bpf: enforce return code for cgroup-bpf programs"),
which is the one that started enforcing via check_return_code()
in range [0, 1].

Btw, your subject from cover letter got somehow messed up a bit:

'[PATCH net-next 0/6] bpf: Fix bugs in sock_ops samples In-Reply-To:'

> Signed-off-by: Lawrence Brakmo <brakmo@...com>
> ---
>   samples/bpf/tcp_synrto_kern.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/samples/bpf/tcp_synrto_kern.c b/samples/bpf/tcp_synrto_kern.c
> index 3c3fc83..232bb24 100644
> --- a/samples/bpf/tcp_synrto_kern.c
> +++ b/samples/bpf/tcp_synrto_kern.c
> @@ -38,8 +38,10 @@ int bpf_synrto(struct bpf_sock_ops *skops)
>   	 * if neither port numberis 55601
>   	 */
>   	if (bpf_ntohl(skops->remote_port) != 55601 &&
> -	    skops->local_port != 55601)
> -		return -1;
> +	    skops->local_port != 55601) {
> +		skops->reply = -1;
> +		return 1;
> +	}
>   
>   	op = (int) skops->op;
>   
>