From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:43371 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752919AbbI3Dd1 (ORCPT ); Tue, 29 Sep 2015 23:33:27 -0400 Subject: Patch "sock, diag: fix panic in sock_diag_put_filterinfo" has been added to the 4.2-stable tree To: daniel@iogearbox.net, ast@plumgrid.com, davem@davemloft.net, gregkh@linuxfoundation.org, nicolas.dichtel@6wind.com Cc: , From: Date: Wed, 30 Sep 2015 05:32:17 +0200 Message-ID: <14435839371516@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled sock, diag: fix panic in sock_diag_put_filterinfo to the 4.2-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: sock-diag-fix-panic-in-sock_diag_put_filterinfo.patch and it can be found in the queue-4.2 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Wed Sep 30 05:25:07 CEST 2015 From: Daniel Borkmann Date: Wed, 2 Sep 2015 14:00:36 +0200 Subject: sock, diag: fix panic in sock_diag_put_filterinfo From: Daniel Borkmann [ Upstream commit b382c08656000c12a146723a153b85b13a855b49 ] diag socket's sock_diag_put_filterinfo() dumps classic BPF programs upon request to user space (ss -0 -b). However, native eBPF programs attached to sockets (SO_ATTACH_BPF) cannot be dumped with this method: Their orig_prog is always NULL. However, sock_diag_put_filterinfo() unconditionally tries to access its filter length resp. wants to copy the filter insns from there. Internal cBPF to eBPF transformations attached to sockets don't have this issue, as orig_prog state is kept. It's currently only used by packet sockets. If we would want to add native eBPF support in the future, this needs to be done through a different attribute than PACKET_DIAG_FILTER to not confuse possible user space disassemblers that work on diag data. Fixes: 89aa075832b0 ("net: sock: allow eBPF programs to be attached to sockets") Signed-off-by: Daniel Borkmann Acked-by: Nicolas Dichtel Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/core/sock_diag.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/core/sock_diag.c +++ b/net/core/sock_diag.c @@ -90,6 +90,9 @@ int sock_diag_put_filterinfo(bool may_re goto out; fprog = filter->prog->orig_prog; + if (!fprog) + goto out; + flen = bpf_classic_proglen(fprog); attr = nla_reserve(skb, attrtype, flen); Patches currently in stable-queue which might be from daniel@iogearbox.net are queue-4.2/ipv6-fix-exthdrs-offload-registration-in-out_rt-path.patch queue-4.2/sock-diag-fix-panic-in-sock_diag_put_filterinfo.patch queue-4.2/netlink-mmap-transform-mmap-skb-into-full-skb-on-taps.patch