summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorRabin Vincent <rabin@rab.in>2016-01-12 20:17:08 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2016-01-31 11:29:01 -0800
commit35987ff2eaa05d70154c5bd28ebb2b70a7d8368b (patch)
tree65236be6744aaf9640ea327efb05c5cc5ded3cc6 /net
parentf7c1aee0b421663447aef58f58f103502bdc47e5 (diff)
net: bpf: reject invalid shifts
[ Upstream commit 229394e8e62a4191d592842cf67e80c62a492937 ] On ARM64, a BUG() is triggered in the eBPF JIT if a filter with a constant shift that can't be encoded in the immediate field of the UBFM/SBFM instructions is passed to the JIT. Since these shifts amounts, which are negative or >= regsize, are invalid, reject them in the eBPF verifier and the classic BPF filter checker, for all architectures. Signed-off-by: Rabin Vincent <rabin@rab.in> Acked-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r--net/core/filter.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/net/core/filter.c b/net/core/filter.c
index 672eefbfbe99..37157c4c1a78 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -777,6 +777,11 @@ static int bpf_check_classic(const struct sock_filter *filter,
if (ftest->k == 0)
return -EINVAL;
break;
+ case BPF_ALU | BPF_LSH | BPF_K:
+ case BPF_ALU | BPF_RSH | BPF_K:
+ if (ftest->k >= 32)
+ return -EINVAL;
+ break;
case BPF_LD | BPF_MEM:
case BPF_LDX | BPF_MEM:
case BPF_ST: