bpf: fix subprog verifier bypass by div/mod by 0 exception

[linux-2.6-microblaze.git] / net / core / filter.c

diff --git a/net/core/filter.c b/net/core/filter.c
index a858ebc..08ab4c6 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -401,8 +401,8 @@ do_pass:
                /* Classic BPF expects A and X to be reset first. These need
                 * to be guaranteed to be the first two instructions.
                 */
-               *new_insn++ = BPF_ALU64_REG(BPF_XOR, BPF_REG_A, BPF_REG_A);
-               *new_insn++ = BPF_ALU64_REG(BPF_XOR, BPF_REG_X, BPF_REG_X);
+               *new_insn++ = BPF_ALU32_REG(BPF_XOR, BPF_REG_A, BPF_REG_A);
+               *new_insn++ = BPF_ALU32_REG(BPF_XOR, BPF_REG_X, BPF_REG_X);
 
                /* All programs must keep CTX in callee saved BPF_REG_CTX.
                 * In eBPF case it's done by the compiler, here we need to
@@ -459,8 +459,15 @@ do_pass:
                                break;
 
                        if (fp->code == (BPF_ALU | BPF_DIV | BPF_X) ||
-                           fp->code == (BPF_ALU | BPF_MOD | BPF_X))
+                           fp->code == (BPF_ALU | BPF_MOD | BPF_X)) {
                                *insn++ = BPF_MOV32_REG(BPF_REG_X, BPF_REG_X);
+                               /* Error with exception code on div/mod by 0.
+                                * For cBPF programs, this was always return 0.
+                                */
+                               *insn++ = BPF_JMP_IMM(BPF_JNE, BPF_REG_X, 0, 2);
+                               *insn++ = BPF_ALU32_REG(BPF_XOR, BPF_REG_A, BPF_REG_A);
+                               *insn++ = BPF_EXIT_INSN();
+                       }
 
                        *insn = BPF_RAW_INSN(fp->code, BPF_REG_A, BPF_REG_X, 0, fp->k);
                        break;
@@ -3232,6 +3239,29 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
                        ret = -EINVAL;
                }
 #ifdef CONFIG_INET
+#if IS_ENABLED(CONFIG_IPV6)
+       } else if (level == SOL_IPV6) {
+               if (optlen != sizeof(int) || sk->sk_family != AF_INET6)
+                       return -EINVAL;
+
+               val = *((int *)optval);
+               /* Only some options are supported */
+               switch (optname) {
+               case IPV6_TCLASS:
+                       if (val < -1 || val > 0xff) {
+                               ret = -EINVAL;
+                       } else {
+                               struct ipv6_pinfo *np = inet6_sk(sk);
+
+                               if (val == -1)
+                                       val = 0;
+                               np->tclass = val;
+                       }
+                       break;
+               default:
+                       ret = -EINVAL;
+               }
+#endif
        } else if (level == SOL_TCP &&
                   sk->sk_prot->setsockopt == tcp_setsockopt) {
                if (optname == TCP_CONGESTION) {
@@ -3241,7 +3271,8 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
                        strncpy(name, optval, min_t(long, optlen,
                                                    TCP_CA_NAME_MAX-1));
                        name[TCP_CA_NAME_MAX-1] = 0;
-                       ret = tcp_set_congestion_control(sk, name, false, reinit);
+                       ret = tcp_set_congestion_control(sk, name, false,
+                                                        reinit);
                } else {
                        struct tcp_sock *tp = tcp_sk(sk);
 
@@ -3307,6 +3338,22 @@ BPF_CALL_5(bpf_getsockopt, struct bpf_sock_ops_kern *, bpf_sock,
                } else {
                        goto err_clear;
                }
+#if IS_ENABLED(CONFIG_IPV6)
+       } else if (level == SOL_IPV6) {
+               struct ipv6_pinfo *np = inet6_sk(sk);
+
+               if (optlen != sizeof(int) || sk->sk_family != AF_INET6)
+                       goto err_clear;
+
+               /* Only some options are supported */
+               switch (optname) {
+               case IPV6_TCLASS:
+                       *((int *)optval) = (int)np->tclass;
+                       break;
+               default:
+                       goto err_clear;
+               }
+#endif
        } else {
                goto err_clear;
        }
@@ -3871,6 +3918,7 @@ static bool sock_ops_is_valid_access(int off, int size,
        if (type == BPF_WRITE) {
                switch (off) {
                case offsetof(struct bpf_sock_ops, reply):
+               case offsetof(struct bpf_sock_ops, sk_txhash):
                        if (size != size_default)
                                return false;
                        break;
@@ -4690,7 +4738,8 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type,
                break;
 
        case offsetof(struct bpf_sock_ops, sk_txhash):
-               SOCK_OPS_GET_FIELD(sk_txhash, sk_txhash, struct sock);
+               SOCK_OPS_GET_OR_SET_FIELD(sk_txhash, sk_txhash,
+                                         struct sock, type);
                break;
 
        case offsetof(struct bpf_sock_ops, bytes_received):
@@ -4701,6 +4750,7 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type,
        case offsetof(struct bpf_sock_ops, bytes_acked):
                SOCK_OPS_GET_FIELD(bytes_acked, bytes_acked, struct tcp_sock);
                break;
+
        }
        return insn - insn_buf;
 }