• Daniel Borkmann's avatar
    sock, diag: fix panic in sock_diag_put_filterinfo · b382c086
    Daniel Borkmann authored
    diag socket's sock_diag_put_filterinfo() dumps classic BPF programs
    upon request to user space (ss -0 -b). However, native eBPF programs
    attached to sockets (SO_ATTACH_BPF) cannot be dumped with this method:
    
    Their orig_prog is always NULL. However, sock_diag_put_filterinfo()
    unconditionally tries to access its filter length resp. wants to copy
    the filter insns from there. Internal cBPF to eBPF transformations
    attached to sockets don't have this issue, as orig_prog state is kept.
    
    It's currently only used by packet sockets. If we would want to add
    native eBPF support in the future, this needs to be done through
    a different attribute than PACKET_DIAG_FILTER to not confuse possible
    user space disassemblers that work on diag data.
    
    Fixes: 89aa0758 ("net: sock: allow eBPF programs to be attached to sockets")
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Acked-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
    Acked-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    b382c086
sock_diag.c 7.97 KB