From patchwork Tue May 2 15:36:33 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Miller X-Patchwork-Id: 757684 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3wHQPk0XRSz9s5L for ; Wed, 3 May 2017 01:36:42 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751157AbdEBPgi (ORCPT ); Tue, 2 May 2017 11:36:38 -0400 Received: from shards.monkeyblade.net ([184.105.139.130]:50082 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750733AbdEBPgf (ORCPT ); Tue, 2 May 2017 11:36:35 -0400 Received: from localhost (67.110.78.66.ptr.us.xo.net [67.110.78.66]) (Authenticated sender: davem-davemloft) by shards.monkeyblade.net (Postfix) with ESMTPSA id 0BC9B122FF844; Tue, 2 May 2017 07:55:07 -0700 (PDT) Date: Tue, 02 May 2017 11:36:33 -0400 (EDT) Message-Id: <20170502.113633.800987081837435647.davem@davemloft.net> To: ast@fb.com CC: daniel@iogearbox.net, netdev@vger.kernel.org Subject: [PATCH 1/2] bpf: Do not dereference user pointer in bpf_test_finish(). From: David Miller X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Tue, 02 May 2017 07:55:08 -0700 (PDT) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Instead, pass the kattr in which has a kernel side copy of this data structure from userspace already. Fix based upon a suggestion from Alexei Starovoitov. Signed-off-by: David S. Miller Acked-by: Daniel Borkmann --- net/bpf/test_run.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index 8a6d0a3..f946912 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -49,10 +49,11 @@ static u32 bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *time) return ret; } -static int bpf_test_finish(union bpf_attr __user *uattr, const void *data, +static int bpf_test_finish(const union bpf_attr *kattr, + union bpf_attr __user *uattr, const void *data, u32 size, u32 retval, u32 duration) { - void __user *data_out = u64_to_user_ptr(uattr->test.data_out); + void __user *data_out = u64_to_user_ptr(kattr->test.data_out); int err = -EFAULT; if (data_out && copy_to_user(data_out, data, size)) @@ -140,7 +141,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, /* bpf program can never convert linear skb to non-linear */ if (WARN_ON_ONCE(skb_is_nonlinear(skb))) size = skb_headlen(skb); - ret = bpf_test_finish(uattr, skb->data, size, retval, duration); + ret = bpf_test_finish(kattr, uattr, skb->data, size, retval, duration); kfree_skb(skb); return ret; } @@ -166,7 +167,7 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr, retval = bpf_test_run(prog, &xdp, repeat, &duration); if (xdp.data != data + XDP_PACKET_HEADROOM) size = xdp.data_end - xdp.data; - ret = bpf_test_finish(uattr, xdp.data, size, retval, duration); + ret = bpf_test_finish(kattr, uattr, xdp.data, size, retval, duration); kfree(data); return ret; }