lkml.org 
[lkml]   [2005]   [Dec]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] Socket filter instruction limit validation
Date
This patch checks to make sure that the number of instructions doesn't surpass
BPF_MAXINSNS in sk_chk_filter().

Signed-off-by: Kris Katterjohn <kjak@users.sourceforge.net>

---

This is a diff from 2.6.15-rc5. And I am not subscribed, so please CC me on any
replies.

The previous check in sk_chk_filter() doesn't seem very logical to me because it
should either be limited to BPF_MAXINSNS or only limited by the max value of an
`int' (not really limited). sk_attach_filter() and get_filter() in
drivers/net/ppp_generic.c limit it to BPF_MAXINSNS, but get_filter() in
drivers/isdn/i4l/isdn_ppp.c and anything else that will use it only get this
seemingly "random" limit.

This way it is checked for in only one place, and has a single constant limit.

Thanks!

--- x/net/core/filter.c 2005-12-06 04:01:50.000000000 -0600
+++ y/net/core/filter.c 2005-12-06 04:04:23.000000000 -0600
@@ -293,7 +293,8 @@ int sk_chk_filter(struct sock_filter *fi
struct sock_filter *ftest;
int pc;

- if (((unsigned int)flen >= (~0U / sizeof(struct sock_filter))) || flen == 0)
+ /* check for valid number of instructions -Kris Katterjohn 2005-12-06 */
+ if (flen == 0 || flen > BPF_MAXINSNS)
return -EINVAL;

/* check the filter code now */
@@ -359,9 +360,9 @@ int sk_attach_filter(struct sock_fprog *
unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
int err;

- /* Make sure new filter is there and in the right amounts. */
- if (fprog->filter == NULL || fprog->len > BPF_MAXINSNS)
- return -EINVAL;
+ /* Make sure new filter is there */
+ if (fprog->filter == NULL)
+ return -EINVAL;

fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
if (!fp)

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-12-06 11:14    [W:0.242 / U:0.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site