diff options
| author | David Miller <davem@davemloft.net> | 2017-05-02 11:36:33 -0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-05-02 11:46:28 -0400 |
| commit | 78e5227237cae9172dd50c3ebb08d4fb31530676 (patch) | |
| tree | dee17546a9954815c29301898074534defeb3b79 /net/bpf | |
| parent | 4e9c3a667135799d50f2778a8a8dae2ca13aafd0 (diff) | |
| download | linux-78e5227237cae9172dd50c3ebb08d4fb31530676.tar.gz linux-78e5227237cae9172dd50c3ebb08d4fb31530676.tar.bz2 linux-78e5227237cae9172dd50c3ebb08d4fb31530676.zip | |
bpf: Do not dereference user pointer in bpf_test_finish().
Instead, pass the kattr in which has a kernel side copy of this
data structure from userspace already.
Fix based upon a suggestion from Alexei Starovoitov.
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat (limited to 'net/bpf')
| -rw-r--r-- | net/bpf/test_run.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index 8a6d0a37c30c..f946912c8a81 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -49,10 +49,11 @@ static u32 bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *time) return ret; } -static int bpf_test_finish(union bpf_attr __user *uattr, const void *data, +static int bpf_test_finish(const union bpf_attr *kattr, + union bpf_attr __user *uattr, const void *data, u32 size, u32 retval, u32 duration) { - void __user *data_out = u64_to_user_ptr(uattr->test.data_out); + void __user *data_out = u64_to_user_ptr(kattr->test.data_out); int err = -EFAULT; if (data_out && copy_to_user(data_out, data, size)) @@ -140,7 +141,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, /* bpf program can never convert linear skb to non-linear */ if (WARN_ON_ONCE(skb_is_nonlinear(skb))) size = skb_headlen(skb); - ret = bpf_test_finish(uattr, skb->data, size, retval, duration); + ret = bpf_test_finish(kattr, uattr, skb->data, size, retval, duration); kfree_skb(skb); return ret; } @@ -166,7 +167,7 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr, retval = bpf_test_run(prog, &xdp, repeat, &duration); if (xdp.data != data + XDP_PACKET_HEADROOM) size = xdp.data_end - xdp.data; - ret = bpf_test_finish(uattr, xdp.data, size, retval, duration); + ret = bpf_test_finish(kattr, uattr, xdp.data, size, retval, duration); kfree(data); return ret; } |