From: David Miller <davem@davemloft•net>
To: ast@fb•com
Cc: daniel@iogearbox•net, netdev@vger•kernel.org
Subject: [PATCH 1/2] bpf: Do not dereference user pointer in bpf_test_finish().
Date: Tue, 02 May 2017 11:36:33 -0400 (EDT) [thread overview]
Message-ID: <20170502.113633.800987081837435647.davem@davemloft.net> (raw)
Instead, pass the kattr in which has a kernel side copy of this
data structure from userspace already.
Fix based upon a suggestion from Alexei Starovoitov.
Signed-off-by: David S. Miller <davem@davemloft•net>
---
net/bpf/test_run.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 8a6d0a3..f946912 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -49,10 +49,11 @@ static u32 bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *time)
return ret;
}
-static int bpf_test_finish(union bpf_attr __user *uattr, const void *data,
+static int bpf_test_finish(const union bpf_attr *kattr,
+ union bpf_attr __user *uattr, const void *data,
u32 size, u32 retval, u32 duration)
{
- void __user *data_out = u64_to_user_ptr(uattr->test.data_out);
+ void __user *data_out = u64_to_user_ptr(kattr->test.data_out);
int err = -EFAULT;
if (data_out && copy_to_user(data_out, data, size))
@@ -140,7 +141,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
/* bpf program can never convert linear skb to non-linear */
if (WARN_ON_ONCE(skb_is_nonlinear(skb)))
size = skb_headlen(skb);
- ret = bpf_test_finish(uattr, skb->data, size, retval, duration);
+ ret = bpf_test_finish(kattr, uattr, skb->data, size, retval, duration);
kfree_skb(skb);
return ret;
}
@@ -166,7 +167,7 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
retval = bpf_test_run(prog, &xdp, repeat, &duration);
if (xdp.data != data + XDP_PACKET_HEADROOM)
size = xdp.data_end - xdp.data;
- ret = bpf_test_finish(uattr, xdp.data, size, retval, duration);
+ ret = bpf_test_finish(kattr, uattr, xdp.data, size, retval, duration);
kfree(data);
return ret;
}
--
2.1.2.532.g19b5d50
next reply other threads:[~2017-05-02 15:36 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-02 15:36 David Miller [this message]
2017-05-02 15:41 ` [PATCH 1/2] bpf: Do not dereference user pointer in bpf_test_finish() Daniel Borkmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170502.113633.800987081837435647.davem@davemloft.net \
--to=davem@davemloft$(echo .)net \
--cc=ast@fb$(echo .)com \
--cc=daniel@iogearbox$(echo .)net \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox