diff options
| author | Eduard Zingerman <eddyz87@gmail.com> | 2026-09-04 01:33:23 -0700 |
|---|---|---|
| committer | Kumar Kartikeya Dwivedi <memxor@gmail.com> | 2026-09-04 12:58:04 +0200 |
| commit | 836b2fe544a5e9b5ce116622cb36fba33838c6fd (patch) | |
| tree | 95e38e4aaa0a6a78e373148b3d0af4aa2ab3d371 /include/net/esp.h | |
| download | linux-stable-836b2fe544a5e9b5ce116622cb36fba33838c6fd.tar.gz linux-stable-836b2fe544a5e9b5ce116622cb36fba33838c6fd.zip | |
selftests/bpf: Check that JMP32 pointer vs zero jumps are not predictedgrafted
Add jmp32_ptr_vs_zero_jne: the fall-through of the 32-bit compare, which
the verifier used to skip, contains an out of bounds map value access,
hence w/o the previous patch the program is accepted. See previous patch
for detailed description.
Reported-by: Nicholas Carlini <npc@anthropic.com>
Suggested-by: Nicholas Carlini <npc@anthropic.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260904083325.2083493-6-eddyz87@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Diffstat (limited to 'include/net/esp.h')
| -rw-r--r-- | include/net/esp.h | 50 |
1 files changed, 50 insertions, 0 deletions
diff --git a/include/net/esp.h b/include/net/esp.h new file mode 100644 index 000000000..322950727 --- /dev/null +++ b/include/net/esp.h @@ -0,0 +1,50 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _NET_ESP_H +#define _NET_ESP_H + +#include <linux/skbuff.h> + +struct ip_esp_hdr; +struct xfrm_state; + +static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb) +{ + return (struct ip_esp_hdr *)skb_transport_header(skb); +} + +static inline void esp_output_fill_trailer(u8 *tail, int tfclen, int plen, __u8 proto) +{ + /* Fill padding... */ + if (tfclen) { + memset(tail, 0, tfclen); + tail += tfclen; + } + do { + int i; + for (i = 0; i < plen - 2; i++) + tail[i] = i + 1; + } while (0); + tail[plen - 2] = plen - 2; + tail[plen - 1] = proto; +} + +struct esp_info { + struct ip_esp_hdr *esph; + __be64 seqno; + int tfclen; + int tailen; + int plen; + int clen; + int len; + int nfrags; + __u8 proto; + bool inplace; +}; + +int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp); +int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp); +int esp_input_done2(struct sk_buff *skb, int err); +int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp); +int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp); +int esp6_input_done2(struct sk_buff *skb, int err); +#endif |