lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sat, 8 Jan 2022 11:37:06 -0800
From:   Alexei Starovoitov <>
To:     Toke Høiland-Jørgensen <>
Cc:     Alexei Starovoitov <>,
        Daniel Borkmann <>,
        "David S. Miller" <>,
        Jakub Kicinski <>,
        Jesper Dangaard Brouer <>,
        John Fastabend <>,
        Andrii Nakryiko <>,
        Martin KaFai Lau <>,
        Song Liu <>, Yonghong Song <>,
        KP Singh <>,
        syzbot <>,
        Network Development <>,
        bpf <>
Subject: Re: [PATCH bpf v2 1/3] xdp: check prog type before updating BPF link

On Fri, Jan 7, 2022 at 2:11 PM Toke Høiland-Jørgensen <> wrote:
> The bpf_xdp_link_update() function didn't check the program type before
> updating the program, which made it possible to install any program type as
> an XDP program, which is obviously not good. Syzbot managed to trigger this
> by swapping in an LWT program on the XDP hook which would crash in a helper
> call.
> Fix this by adding a check and bailing out if the types don't match.
> Fixes: 026a4c28e1db ("bpf, xdp: Implement LINK_UPDATE for BPF XDP link")
> Reported-by:
> Acked-by: Andrii Nakryiko <>
> Signed-off-by: Toke Høiland-Jørgensen <>

Thanks a lot for the quick fix!
The merge window is about to begin.
We will land it as soon as possible when bpf tree will be ready
to accept fixes.

Powered by blists - more mailing lists