From: Geliang Tang <tanggeliang@kylinos.cn>
Zero iterator state on error paths and add sk_type == SOCK_STREAM check to
prevent raw sockets from bypassing validation.
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
---
net/mptcp/bpf.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/net/mptcp/bpf.c b/net/mptcp/bpf.c
index 08bb037f0951..cb2dddb7c3a6 100644
--- a/net/mptcp/bpf.c
+++ b/net/mptcp/bpf.c
@@ -252,11 +252,18 @@ bpf_iter_mptcp_subflow_new(struct bpf_iter_mptcp_subflow *it,
BUILD_BUG_ON(__alignof__(struct bpf_iter_mptcp_subflow_kern) !=
__alignof__(struct bpf_iter_mptcp_subflow));
- if (unlikely(!sk || !sk_fullsock(sk)))
+ if (unlikely(!sk || !sk_fullsock(sk))) {
+ kit->msk = NULL;
+ kit->pos = NULL;
return -EINVAL;
+ }
- if (sk->sk_protocol != IPPROTO_MPTCP)
+ if (sk->sk_type != SOCK_STREAM ||
+ sk->sk_protocol != IPPROTO_MPTCP) {
+ kit->msk = NULL;
+ kit->pos = NULL;
return -EINVAL;
+ }
msk = mptcp_sk(sk);
--
2.53.0