nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

net: filter: initialize A and X registers

Browse source 
exisiting BPF verifier allows uninitialized access to registers,
'ret A' is considered to be a valid filter.
So initialize A and X to zero to prevent leaking kernel memory
In the future BPF verifier will be rejecting such filters

Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Cc: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Alexei Starovoitov 2014-04-22 20:18:57 -07:00 committed by David S. Miller
parent c06cbcb605
commit 83d5b7ef99
1 changed files with 9 additions and 7 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

16
net/core/filter.c
View file

@ -122,6 +122,13 @@ noinline u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
return 0; return 0;
} }
/* Register mappings for user programs. */
#define A_REG 0
#define X_REG 7
#define TMP_REG 8
#define ARG2_REG 2
#define ARG3_REG 3
/** /**
* __sk_run_filter - run a filter on a given context * __sk_run_filter - run a filter on a given context
* @ctx: buffer to run the filter on * @ctx: buffer to run the filter on
@ -242,6 +249,8 @@ unsigned int __sk_run_filter(void *ctx, const struct sock_filter_int *insn)
regs[FP_REG] = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)]; regs[FP_REG] = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)];
regs[ARG1_REG] = (u64) (unsigned long) ctx; regs[ARG1_REG] = (u64) (unsigned long) ctx;
regs[A_REG] = 0;
regs[X_REG] = 0;
select_insn: select_insn:
goto *jumptable[insn->code]; goto *jumptable[insn->code];
@ -643,13 +652,6 @@ static u64 __get_raw_cpu_id(u64 ctx, u64 A, u64 X, u64 r4, u64 r5)
return raw_smp_processor_id(); return raw_smp_processor_id();
} }
/* Register mappings for user programs. */
#define A_REG 0
#define X_REG 7
#define TMP_REG 8
#define ARG2_REG 2
#define ARG3_REG 3
static bool convert_bpf_extensions(struct sock_filter *fp, static bool convert_bpf_extensions(struct sock_filter *fp,
struct sock_filter_int **insnp) struct sock_filter_int **insnp)
{ {