evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

bpf: reject wrong sized filters earlier

Browse source 
commit f7bd9e36ee4a4ce38e1cddd7effe6c0d9943285b upstream.

Add a bpf_check_basics_ok() and reject filters that are of invalid
size much earlier, so we don't do any useless work such as invoking
bpf_prog_alloc(). Currently, rejection happens in bpf_check_classic()
only, but it's really unnecessarily late and they should be rejected
at earliest point. While at it, also clean up one bpf_prog_size() to
make it consistent with the remaining invocations.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Zubin Mithra <zsm@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Daniel Borkmann 2016-06-10 21:19:07 +02:00 • committed by Greg Kroah-Hartman
parent 0b7d9b8571
commit f08db490b4
1 changed files with 15 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
net/core/filter.c
View file

@ -742,6 +742,17 @@ static bool chk_code_allowed(u16 code_to_probe)
return codes[code_to_probe]; return codes[code_to_probe];
} }
static bool bpf_check_basics_ok(const struct sock_filter *filter,
unsigned int flen)
{
if (filter == NULL)
return false;
if (flen == 0 || flen > BPF_MAXINSNS)
return false;
return true;
}
/** /**
* bpf_check_classic - verify socket filter code * bpf_check_classic - verify socket filter code
* @filter: filter to verify * @filter: filter to verify
@ -762,9 +773,6 @@ static int bpf_check_classic(const struct sock_filter *filter,
bool anc_found; bool anc_found;
int pc; int pc;
if (flen == 0 || flen > BPF_MAXINSNS)
return -EINVAL;
/* Check the filter code now */ /* Check the filter code now */
for (pc = 0; pc < flen; pc++) { for (pc = 0; pc < flen; pc++) {
const struct sock_filter *ftest = &filter[pc]; const struct sock_filter *ftest = &filter[pc];
@ -1057,7 +1065,7 @@ int bpf_prog_create(struct bpf_prog **pfp, struct sock_fprog_kern *fprog)
struct bpf_prog *fp; struct bpf_prog *fp;
/* Make sure new filter is there and in the right amounts. */ /* Make sure new filter is there and in the right amounts. */
if (fprog->filter == NULL) if (!bpf_check_basics_ok(fprog->filter, fprog->len))
return -EINVAL; return -EINVAL;
fp = bpf_prog_alloc(bpf_prog_size(fprog->len), 0); fp = bpf_prog_alloc(bpf_prog_size(fprog->len), 0);
@ -1104,7 +1112,7 @@ int bpf_prog_create_from_user(struct bpf_prog **pfp, struct sock_fprog *fprog,
int err; int err;
/* Make sure new filter is there and in the right amounts. */ /* Make sure new filter is there and in the right amounts. */
if (fprog->filter == NULL) if (!bpf_check_basics_ok(fprog->filter, fprog->len))
return -EINVAL; return -EINVAL;
fp = bpf_prog_alloc(bpf_prog_size(fprog->len), 0); fp = bpf_prog_alloc(bpf_prog_size(fprog->len), 0);
@ -1184,7 +1192,6 @@ int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk,
bool locked) bool locked)
{ {
unsigned int fsize = bpf_classic_proglen(fprog); unsigned int fsize = bpf_classic_proglen(fprog);
unsigned int bpf_fsize = bpf_prog_size(fprog->len);
struct bpf_prog *prog; struct bpf_prog *prog;
int err; int err;
@ -1192,10 +1199,10 @@ int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk,
return -EPERM; return -EPERM;
/* Make sure new filter is there and in the right amounts. */ /* Make sure new filter is there and in the right amounts. */
if (fprog->filter == NULL) if (!bpf_check_basics_ok(fprog->filter, fprog->len))
return -EINVAL; return -EINVAL;
prog = bpf_prog_alloc(bpf_fsize, 0); prog = bpf_prog_alloc(bpf_prog_size(fprog->len), 0);
if (!prog) if (!prog)
return -ENOMEM; return -ENOMEM;