Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 83d5b7ef authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by David S. Miller
Browse files

net: filter: initialize A and X registers 



exisiting BPF verifier allows uninitialized access to registers,
'ret A' is considered to be a valid filter.
So initialize A and X to zero to prevent leaking kernel memory
In the future BPF verifier will be rejecting such filters

Signed-off-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
Cc: Daniel Borkmann <dborkman@redhat.com>
Acked-by: default avatarDaniel Borkmann <dborkman@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c06cbcb6

net/core/filter.c

+9 −7
Original line number Diff line number Diff line
@@ -122,6 +122,13 @@ noinline u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5) 
	return 0;

}



/* Register mappings for user programs. */

#define A_REG		0

#define X_REG		7

#define TMP_REG		8

#define ARG2_REG	2

#define ARG3_REG	3



/**

 *	__sk_run_filter - run a filter on a given context

 *	@ctx: buffer to run the filter on
@@ -242,6 +249,8 @@ unsigned int __sk_run_filter(void *ctx, const struct sock_filter_int *insn) 


	regs[FP_REG]  = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)];

	regs[ARG1_REG] = (u64) (unsigned long) ctx;

	regs[A_REG] = 0;

	regs[X_REG] = 0;



select_insn:

	goto *jumptable[insn->code];
@@ -643,13 +652,6 @@ static u64 __get_raw_cpu_id(u64 ctx, u64 A, u64 X, u64 r4, u64 r5) 
	return raw_smp_processor_id();

}



/* Register mappings for user programs. */

#define A_REG		0

#define X_REG		7

#define TMP_REG		8

#define ARG2_REG	2

#define ARG3_REG	3



static bool convert_bpf_extensions(struct sock_filter *fp,

				   struct sock_filter_int **insnp)

{