net: filter: initialize A and X registers
exisiting BPF verifier allows uninitialized access to registers, 'ret A' is considered to be a valid filter. So initialize A and X to zero to prevent leaking kernel memory In the future BPF verifier will be rejecting such filters Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Cc: Daniel Borkmann <dborkman@redhat.com> Acked-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
c06cbcb605
commit
83d5b7ef99
|
@ -122,6 +122,13 @@ noinline u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* Register mappings for user programs. */
|
||||||
|
#define A_REG 0
|
||||||
|
#define X_REG 7
|
||||||
|
#define TMP_REG 8
|
||||||
|
#define ARG2_REG 2
|
||||||
|
#define ARG3_REG 3
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* __sk_run_filter - run a filter on a given context
|
* __sk_run_filter - run a filter on a given context
|
||||||
* @ctx: buffer to run the filter on
|
* @ctx: buffer to run the filter on
|
||||||
|
@ -242,6 +249,8 @@ unsigned int __sk_run_filter(void *ctx, const struct sock_filter_int *insn)
|
||||||
|
|
||||||
regs[FP_REG] = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)];
|
regs[FP_REG] = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)];
|
||||||
regs[ARG1_REG] = (u64) (unsigned long) ctx;
|
regs[ARG1_REG] = (u64) (unsigned long) ctx;
|
||||||
|
regs[A_REG] = 0;
|
||||||
|
regs[X_REG] = 0;
|
||||||
|
|
||||||
select_insn:
|
select_insn:
|
||||||
goto *jumptable[insn->code];
|
goto *jumptable[insn->code];
|
||||||
|
@ -643,13 +652,6 @@ static u64 __get_raw_cpu_id(u64 ctx, u64 A, u64 X, u64 r4, u64 r5)
|
||||||
return raw_smp_processor_id();
|
return raw_smp_processor_id();
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Register mappings for user programs. */
|
|
||||||
#define A_REG 0
|
|
||||||
#define X_REG 7
|
|
||||||
#define TMP_REG 8
|
|
||||||
#define ARG2_REG 2
|
|
||||||
#define ARG3_REG 3
|
|
||||||
|
|
||||||
static bool convert_bpf_extensions(struct sock_filter *fp,
|
static bool convert_bpf_extensions(struct sock_filter *fp,
|
||||||
struct sock_filter_int **insnp)
|
struct sock_filter_int **insnp)
|
||||||
{
|
{
|
||||||
|
|
Loading…
Reference in New Issue