Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1254811

[PATCH 4.1 09/46] bpf: fix panic in SO_GET_FILTER with native ebpf programs

Show all headers | View raw

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <daniel@iogearbox.net>

[ Upstream commit 93d08b6966cf730ea669d4d98f43627597077153 ]

When sockets have a native eBPF program attached through
setsockopt(sk, SOL_SOCKET, SO_ATTACH_BPF, ...), and then try to
dump these over getsockopt(sk, SOL_SOCKET, SO_GET_FILTER, ...),
the following panic appears:

  [49904.178642] BUG: unable to handle kernel NULL pointer dereference at (null)
  [49904.178762] IP: [<ffffffff81610fd9>] sk_get_filter+0x39/0x90
  [49904.182000] PGD 86fc9067 PUD 531a1067 PMD 0
  [49904.185196] Oops: 0000 [#1] SMP
  [...]
  [49904.224677] Call Trace:
  [49904.226090]  [<ffffffff815e3d49>] sock_getsockopt+0x319/0x740
  [49904.227535]  [<ffffffff812f59e3>] ? sock_has_perm+0x63/0x70
  [49904.228953]  [<ffffffff815e2fc8>] ? release_sock+0x108/0x150
  [49904.230380]  [<ffffffff812f5a43>] ? selinux_socket_getsockopt+0x23/0x30
  [49904.231788]  [<ffffffff815dff36>] SyS_getsockopt+0xa6/0xc0
  [49904.233267]  [<ffffffff8171b9ae>] entry_SYSCALL_64_fastpath+0x12/0x71

The underlying issue is the very same as in commit b382c0865600
("sock, diag: fix panic in sock_diag_put_filterinfo"), that is,
native eBPF programs don't store an original program since this
is only needed in cBPF ones.

However, sk_get_filter() wasn't updated to test for this at the
time when eBPF could be attached. Just throw an error to the user
to indicate that eBPF cannot be dumped over this interface.
That way, it can also be known that a program _is_ attached (as
opposed to just return 0), and a different (future) method needs
to be consulted for a dump.

Fixes: 89aa075832b0 ("net: sock: allow eBPF programs to be attached to sockets")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/filter.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1526,9 +1526,13 @@ int sk_get_filter(struct sock *sk, struc
 		goto out;
 
 	/* We're copying the filter that has been originally attached,
-	 * so no conversion/decode needed anymore.
+	 * so no conversion/decode needed anymore. eBPF programs that
+	 * have no original program cannot be dumped through this.
 	 */
+	ret = -EACCES;
 	fprog = filter->prog->orig_prog;
+	if (!fprog)
+		goto out;
 
 	ret = fprog->len;
 	if (!len)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.1 00/46] 4.1.12-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 05/46] inet: fix races in reqsk_queue_hash_req() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 06/46] net: add pfmemalloc check in sk_add_backlog() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 04/46] skbuff: Fix skb checksum partial check. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 02/46] l2tp: protect tunnel->del_work by ref_count Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 16/46] af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 30/46] i2c: designware-platdrv: enable RuntimePM before registering to the core Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 29/46] i2c: designware: Do not use parameters from ACPI on Dell Inspiron 7348 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 34/46] drm/radeon: attach tile property to mst connector Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 17/46] net/unix: fix logic about sk_peek_offset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 32/46] drm/nouveau/fbcon: take runpm reference when userspace has an open fd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 09/46] bpf: fix panic in SO_GET_FILTER with native ebpf programs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 27/46] i2c: rcar: enable RuntimePM before registering to the core Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 31/46] workqueue: make sure delayed work run in local cpu Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
  [PATCH 4.1 39/46] sched/preempt: Fix cond_resched_lock() and cond_resched_softirq() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:10 +0200
    Re: [PATCH 4.1 39/46] sched/preempt: Fix cond_resched_lock() and  cond_resched_softirq() Thomas Backlund <backlund.thomas@gmail.com> - 2015-10-23 22:20 +0200
      Re: [PATCH 4.1 39/46] sched/preempt: Fix cond_resched_lock() and  cond_resched_softirq() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-24 01:30 +0200
  Re: [PATCH 4.1 00/46] 4.1.12-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-10-23 22:40 +0200
    Re: [PATCH 4.1 00/46] 4.1.12-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-24 01:30 +0200
      Re: [PATCH 4.1 00/46] 4.1.12-stable review Guenter Roeck <linux@roeck-us.net> - 2015-10-24 03:20 +0200
  Re: [PATCH 4.1 00/46] 4.1.12-stable review Guenter Roeck <linux@roeck-us.net> - 2015-10-24 05:20 +0200
    Re: [PATCH 4.1 00/46] 4.1.12-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-24 15:30 +0200

csiph-web