Commit 78e52272 authored by David Miller's avatar David Miller Committed by David S. Miller
Browse files

bpf: Do not dereference user pointer in bpf_test_finish(). 



Instead, pass the kattr in which has a kernel side copy of this
data structure from userspace already.

Fix based upon a suggestion from Alexei Starovoitov.

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent 4e9c3a66

net/bpf/test_run.c

+5 −4
Original line number Diff line number Diff line
@@ -49,10 +49,11 @@ static u32 bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *time) 
	return ret;

}



static int bpf_test_finish(union bpf_attr __user *uattr, const void *data,

static int bpf_test_finish(const union bpf_attr *kattr,

			   union bpf_attr __user *uattr, const void *data,

			   u32 size, u32 retval, u32 duration)

{

	void __user *data_out = u64_to_user_ptr(uattr->test.data_out);

	void __user *data_out = u64_to_user_ptr(kattr->test.data_out);

	int err = -EFAULT;



	if (data_out && copy_to_user(data_out, data, size))
@@ -140,7 +141,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, 
	/* bpf program can never convert linear skb to non-linear */

	if (WARN_ON_ONCE(skb_is_nonlinear(skb)))

		size = skb_headlen(skb);

	ret = bpf_test_finish(uattr, skb->data, size, retval, duration);

	ret = bpf_test_finish(kattr, uattr, skb->data, size, retval, duration);

	kfree_skb(skb);

	return ret;

}
@@ -166,7 +167,7 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr, 
	retval = bpf_test_run(prog, &xdp, repeat, &duration);

	if (xdp.data != data + XDP_PACKET_HEADROOM)

		size = xdp.data_end - xdp.data;

	ret = bpf_test_finish(uattr, xdp.data, size, retval, duration);

	ret = bpf_test_finish(kattr, uattr, xdp.data, size, retval, duration);

	kfree(data);

	return ret;

}