bpf: simplify __is_valid_access test on cb

The __is_valid_access() test for cb[] from 62c7989b24db ("bpf: allow
b/h/w/dw access for bpf's cb in ctx") was done unnecessarily complex,
we can just simplify it the same way as recent fix from 2d071c643f1c
("bpf, trace: make ctx access checks more robust") did. Overflow can
never happen as size is 1/2/4/8 depending on access.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/core/filter.c b/net/core/filter.c
index 90383860e224943345724de98310721a51e6f04e..883975fa4ed1b7b20c4ef639a9ddbb46bf8e12a3 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2784,19 +2784,8 @@ static bool __is_valid_access(int off, int size)
        switch (off) {
        case offsetof(struct __sk_buff, cb[0]) ...
             offsetof(struct __sk_buff, cb[4]) + sizeof(__u32) - 1:
-               if (size == sizeof(__u16) &&
-                   off > offsetof(struct __sk_buff, cb[4]) + sizeof(__u16))
-                       return false;
-               if (size == sizeof(__u32) &&
-                   off > offsetof(struct __sk_buff, cb[4]))
-                       return false;
-               if (size == sizeof(__u64) &&
-                   off > offsetof(struct __sk_buff, cb[2]))
-                       return false;
-               if (size != sizeof(__u8)  &&
-                   size != sizeof(__u16) &&
-                   size != sizeof(__u32) &&
-                   size != sizeof(__u64))
+               if (off + size >
+                   offsetof(struct __sk_buff, cb[4]) + sizeof(__u32))
                        return false;
                break;
        default: