From: Josef Bacik Through bpf_dynptr_write() and bpf_dynptr_copy() the source of bpf_skb_store_bytes() can be a slice of the same skb which overlaps the destination. memcpy() then reads bytes which it has overwritten already. On x86 with FSRM it repeats the first bytes of the source instead of copying it. The other kinds of dynptr are written with memmove() for that reason. Fixes: 2012c867c800 ("bpf: verifier: Accept dynptr mem as mem in helpers") Signed-off-by: Josef Bacik Signed-off-by: Alexei Starovoitov --- net/core/filter.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index 54e9084b9263..0e3261f8d322 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -1731,7 +1731,8 @@ BPF_CALL_5(bpf_skb_store_bytes, struct sk_buff *, skb, u32, offset, if (flags & BPF_F_RECOMPUTE_CSUM) __skb_postpull_rcsum(skb, ptr, len, offset); - memcpy(ptr, from, len); + /* through a dynptr the source may be an overlapping slice of the skb */ + memmove(ptr, from, len); if (flags & BPF_F_RECOMPUTE_CSUM) __skb_postpush_rcsum(skb, ptr, len, offset); -- 2.55.0