summaryrefslogtreecommitdiffstats
path: root/net/core
diff options
context:
space:
mode:
authorRabin Vincent <rabin@rab.in>2016-01-12 20:17:08 +0100
committerDavid S. Miller <davem@davemloft.net>2016-01-12 23:06:53 +0100
commit229394e8e62a4191d592842cf67e80c62a492937 (patch)
treeb16b3b389afb1bb660373bab3ec2f986d99a6e13 /net/core
parentphonet: properly unshare skbs in phonet_rcv() (diff)
downloadlinux-229394e8e62a4191d592842cf67e80c62a492937.tar.xz
linux-229394e8e62a4191d592842cf67e80c62a492937.zip
net: bpf: reject invalid shifts
On ARM64, a BUG() is triggered in the eBPF JIT if a filter with a constant shift that can't be encoded in the immediate field of the UBFM/SBFM instructions is passed to the JIT. Since these shifts amounts, which are negative or >= regsize, are invalid, reject them in the eBPF verifier and the classic BPF filter checker, for all architectures. Signed-off-by: Rabin Vincent <rabin@rab.in> Acked-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
-rw-r--r--net/core/filter.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/net/core/filter.c b/net/core/filter.c
index 77cdfb455e7f..94d26201080d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -785,6 +785,11 @@ static int bpf_check_classic(const struct sock_filter *filter,
if (ftest->k == 0)
return -EINVAL;
break;
+ case BPF_ALU | BPF_LSH | BPF_K:
+ case BPF_ALU | BPF_RSH | BPF_K:
+ if (ftest->k >= 32)
+ return -EINVAL;
+ break;
case BPF_LD | BPF_MEM:
case BPF_LDX | BPF_MEM:
case BPF_ST: