bpf: fix direct packet access for flow dissector progs

Commit d58e468b1112 ("flow_dissector: implements flow dissector BPF
hook") added direct packet access for skbs in may_access_direct_pkt_data()
function where this enables read and write access to the skb->data. This
is buggy because without a prologue generator such as bpf_unclone_prologue()
we would allow for writing into cloned skbs. Original intention might have
been to only allow read access where this is not needed (similar as the
flow_dissector_func_proto() indicates which enables only bpf_skb_load_bytes()
as well), therefore this patch fixes it to restrict to read-only.

Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Cc: Petar Penkov <ppenkov@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 4 insertions, 2 deletions

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 98fa0be35370..b0cc8f2ff95f 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1387,21 +1387,23 @@ static bool may_access_direct_pkt_data(struct bpf_verifier_env *env,
                                        enum bpf_access_type t)
 {
         switch (env->prog->type) {
+        /* Program types only with direct read access go here! */
         case BPF_PROG_TYPE_LWT_IN:
         case BPF_PROG_TYPE_LWT_OUT:
         case BPF_PROG_TYPE_LWT_SEG6LOCAL:
         case BPF_PROG_TYPE_SK_REUSEPORT:
-                /* dst_input() and dst_output() can't write for now */
+        case BPF_PROG_TYPE_FLOW_DISSECTOR:
                 if (t == BPF_WRITE)
                         return false;
                 /* fallthrough */
+
+        /* Program types with direct read + write access go here! */
         case BPF_PROG_TYPE_SCHED_CLS:
         case BPF_PROG_TYPE_SCHED_ACT:
         case BPF_PROG_TYPE_XDP:
         case BPF_PROG_TYPE_LWT_XMIT:
         case BPF_PROG_TYPE_SK_SKB:
         case BPF_PROG_TYPE_SK_MSG:
-        case BPF_PROG_TYPE_FLOW_DISSECTOR:
                 if (meta)
                         return meta->pkt_access;