OpenSDV
/
linux-stable-rt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

filter: make sure filters dont read uninitialized memory 

There is a possibility malicious users can get limited information about
uninitialized stack mem array. Even if sk_run_filter() result is bound
to packet length (0 .. 65535), we could imagine this can be used by
hostile user.

Initializing mem[] array, like Dan Rosenberg suggested in his patch is
expensive since most filters dont even use this array.

Its hard to make the filter validation in sk_chk_filter(), because of
the jumps. This might be done later.

In this patch, I use a bitmap (a single long var) so that only filters
using mem[] loads/stores pay the price of added security checks.

For other filters, additional cost is a single instruction.

[ Since we access fentry->k a lot now, cache it in a local variable
  and mark filter entry pointer as const. -DaveM ]

Reported-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2010-11-10 10:38:24 -08:00
parent fe10ae5338
commit 57fe93b374
1 changed files with 35 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
net/core/filter.c
View File

@ -112,39 +112,41 @@ EXPORT_SYMBOL(sk_filter);
*/ */
unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen) unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
{ {
struct sock_filter *fentry; /* We walk down these */
void *ptr; void *ptr;
u32 A = 0; /* Accumulator */ u32 A = 0; /* Accumulator */
u32 X = 0; /* Index Register */ u32 X = 0; /* Index Register */
u32 mem[BPF_MEMWORDS]; /* Scratch Memory Store */ u32 mem[BPF_MEMWORDS]; /* Scratch Memory Store */
unsigned long memvalid = 0;
u32 tmp; u32 tmp;
int k; int k;
int pc; int pc;
BUILD_BUG_ON(BPF_MEMWORDS > BITS_PER_LONG);
/* /*
* Process array of filter instructions. * Process array of filter instructions.
*/ */
for (pc = 0; pc < flen; pc++) { for (pc = 0; pc < flen; pc++) {
fentry = &filter[pc]; const struct sock_filter *fentry = &filter[pc];
u32 f_k = fentry->k;
switch (fentry->code) { switch (fentry->code) {
case BPF_S_ALU_ADD_X: case BPF_S_ALU_ADD_X:
A += X; A += X;
continue; continue;
case BPF_S_ALU_ADD_K: case BPF_S_ALU_ADD_K:
A += fentry->k; A += f_k;
continue; continue;
case BPF_S_ALU_SUB_X: case BPF_S_ALU_SUB_X:
A -= X; A -= X;
continue; continue;
case BPF_S_ALU_SUB_K: case BPF_S_ALU_SUB_K:
A -= fentry->k; A -= f_k;
continue; continue;
case BPF_S_ALU_MUL_X: case BPF_S_ALU_MUL_X:
A *= X; A *= X;
continue; continue;
case BPF_S_ALU_MUL_K: case BPF_S_ALU_MUL_K:
A *= fentry->k; A *= f_k;
continue; continue;
case BPF_S_ALU_DIV_X: case BPF_S_ALU_DIV_X:
if (X == 0) if (X == 0)
@ -152,49 +154,49 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int
A /= X; A /= X;
continue; continue;
case BPF_S_ALU_DIV_K: case BPF_S_ALU_DIV_K:
A /= fentry->k; A /= f_k;
continue; continue;
case BPF_S_ALU_AND_X: case BPF_S_ALU_AND_X:
A &= X; A &= X;
continue; continue;
case BPF_S_ALU_AND_K: case BPF_S_ALU_AND_K:
A &= fentry->k; A &= f_k;
continue; continue;
case BPF_S_ALU_OR_X: case BPF_S_ALU_OR_X:
A |= X; A |= X;
continue; continue;
case BPF_S_ALU_OR_K: case BPF_S_ALU_OR_K:
A |= fentry->k; A |= f_k;
continue; continue;
case BPF_S_ALU_LSH_X: case BPF_S_ALU_LSH_X:
A <<= X; A <<= X;
continue; continue;
case BPF_S_ALU_LSH_K: case BPF_S_ALU_LSH_K:
A <<= fentry->k; A <<= f_k;
continue; continue;
case BPF_S_ALU_RSH_X: case BPF_S_ALU_RSH_X:
A >>= X; A >>= X;
continue; continue;
case BPF_S_ALU_RSH_K: case BPF_S_ALU_RSH_K:
A >>= fentry->k; A >>= f_k;
continue; continue;
case BPF_S_ALU_NEG: case BPF_S_ALU_NEG:
A = -A; A = -A;
continue; continue;
case BPF_S_JMP_JA: case BPF_S_JMP_JA:
pc += fentry->k; pc += f_k;
continue; continue;
case BPF_S_JMP_JGT_K: case BPF_S_JMP_JGT_K:
pc += (A > fentry->k) ? fentry->jt : fentry->jf; pc += (A > f_k) ? fentry->jt : fentry->jf;
continue; continue;
case BPF_S_JMP_JGE_K: case BPF_S_JMP_JGE_K:
pc += (A >= fentry->k) ? fentry->jt : fentry->jf; pc += (A >= f_k) ? fentry->jt : fentry->jf;
continue; continue;
case BPF_S_JMP_JEQ_K: case BPF_S_JMP_JEQ_K:
pc += (A == fentry->k) ? fentry->jt : fentry->jf; pc += (A == f_k) ? fentry->jt : fentry->jf;
continue; continue;
case BPF_S_JMP_JSET_K: case BPF_S_JMP_JSET_K:
pc += (A & fentry->k) ? fentry->jt : fentry->jf; pc += (A & f_k) ? fentry->jt : fentry->jf;
continue; continue;
case BPF_S_JMP_JGT_X: case BPF_S_JMP_JGT_X:
pc += (A > X) ? fentry->jt : fentry->jf; pc += (A > X) ? fentry->jt : fentry->jf;
@ -209,7 +211,7 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int
pc += (A & X) ? fentry->jt : fentry->jf; pc += (A & X) ? fentry->jt : fentry->jf;
continue; continue;
case BPF_S_LD_W_ABS: case BPF_S_LD_W_ABS:
k = fentry->k; k = f_k;
load_w: load_w:
ptr = load_pointer(skb, k, 4, &tmp); ptr = load_pointer(skb, k, 4, &tmp);
if (ptr != NULL) { if (ptr != NULL) {
@ -218,7 +220,7 @@ load_w:
} }
break; break;
case BPF_S_LD_H_ABS: case BPF_S_LD_H_ABS:
k = fentry->k; k = f_k;
load_h: load_h:
ptr = load_pointer(skb, k, 2, &tmp); ptr = load_pointer(skb, k, 2, &tmp);
if (ptr != NULL) { if (ptr != NULL) {
@ -227,7 +229,7 @@ load_h:
} }
break; break;
case BPF_S_LD_B_ABS: case BPF_S_LD_B_ABS:
k = fentry->k; k = f_k;
load_b: load_b:
ptr = load_pointer(skb, k, 1, &tmp); ptr = load_pointer(skb, k, 1, &tmp);
if (ptr != NULL) { if (ptr != NULL) {
@ -242,32 +244,34 @@ load_b:
X = skb->len; X = skb->len;
continue; continue;
case BPF_S_LD_W_IND: case BPF_S_LD_W_IND:
k = X + fentry->k; k = X + f_k;
goto load_w; goto load_w;
case BPF_S_LD_H_IND: case BPF_S_LD_H_IND:
k = X + fentry->k; k = X + f_k;
goto load_h; goto load_h;
case BPF_S_LD_B_IND: case BPF_S_LD_B_IND:
k = X + fentry->k; k = X + f_k;
goto load_b; goto load_b;
case BPF_S_LDX_B_MSH: case BPF_S_LDX_B_MSH:
ptr = load_pointer(skb, fentry->k, 1, &tmp); ptr = load_pointer(skb, f_k, 1, &tmp);
if (ptr != NULL) { if (ptr != NULL) {
X = (*(u8 *)ptr & 0xf) << 2; X = (*(u8 *)ptr & 0xf) << 2;
continue; continue;
} }
return 0; return 0;
case BPF_S_LD_IMM: case BPF_S_LD_IMM:
A = fentry->k; A = f_k;
continue; continue;
case BPF_S_LDX_IMM: case BPF_S_LDX_IMM:
X = fentry->k; X = f_k;
continue; continue;
case BPF_S_LD_MEM: case BPF_S_LD_MEM:
A = mem[fentry->k]; A = (memvalid & (1UL << f_k)) ?
mem[f_k] : 0;
continue; continue;
case BPF_S_LDX_MEM: case BPF_S_LDX_MEM:
X = mem[fentry->k]; X = (memvalid & (1UL << f_k)) ?
mem[f_k] : 0;
continue; continue;
case BPF_S_MISC_TAX: case BPF_S_MISC_TAX:
X = A; X = A;
@ -276,14 +280,16 @@ load_b:
A = X; A = X;
continue; continue;
case BPF_S_RET_K: case BPF_S_RET_K:
return fentry->k; return f_k;
case BPF_S_RET_A: case BPF_S_RET_A:
return A; return A;
case BPF_S_ST: case BPF_S_ST:
mem[fentry->k] = A; memvalid |= 1UL << f_k;
mem[f_k] = A;
continue; continue;
case BPF_S_STX: case BPF_S_STX:
mem[fentry->k] = X; memvalid |= 1UL << f_k;
mem[f_k] = X;
continue; continue;
default: default:
WARN_ON(1); WARN_ON(1);