Re: [PATCH net-next-2.6] filter: add a security check at install time

Eric Dumazet
2010-12-02T13:14:06Z

Le jeudi 02 décembre 2010 à 19:29 +0800, Changli Gao a écrit :
> On Thu, Dec 2, 2010 at 7:15 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> >
> > Their scratch memory is not on stack but part of the filter, so no
> > security problem (You can only read previous values of scratch registers
> > written by your own filter on handling a previous packet.)
> >
>
> The code I checked is the newest in SVN. The scratch memory is really on stack.
>

> u_int
> bpf_filter(const struct bpf_insn *pc, u_char *p, u_int wirelen, u_int buflen)
> {
> u_int32_t A = 0, X = 0;
> bpf_u_int32 k;
> u_int32_t mem[BPF_MEMWORDS];
>
>
>

This legacy code is not used on x86 now they have JIT by default ?

My remark about SMP 'problem' was about their JIT implementation.

net/bpf_jitter.h
/* Structure describing a native filtering program created by the jitter. */

typedef struct bpf_jit_filter {
/* The native filtering binary, in the form of a bpf_filter_func. */
bpf_filter_func func;

int mem[BPF_MEMWORDS]; /* Scratch memory */
} bpf_jit_filter;

Apparently they use locking around this stuff

BPFD_LOCK(d);
...
bf = bpf_jitter_enable != 0 ? d->bd_bfilter : NULL;
if (bf != NULL)
slen = (*(bf->func))(pkt, pktlen, pktlen);
else
slen = bpf_filter(d->bd_rfilter, pkt, pktlen, pktlen);

BPFD_UNLOCK(d);