[PATCH 01/24] bpfilter: reject kernel addresses
Christoph Hellwig <[email protected]>
| Newsgroups | org.kernel.vger.dccp,dev.linux.lists.bridge,dev.linux.lists.mptcp,org.kernel.vger.bpf,org.kernel.vger.linux-bluetooth,org.kernel.vger.linux-can,org.kernel.vger.linux-crypto,org.kernel.vger.linux-hams,org.kernel.vger.linux-kernel,org.kernel.vger.linux-s390,org.kernel.vger.linux-sctp,org.kernel.vger.linux-wpan,org.kernel.vger.linux-x25,org.kernel.vger.lvs-devel,org.kernel.vger.netdev,org.kernel.vger.netfilter-devel |
|---|---|
| Message-ID | <[email protected]> |
When feeding addresses to userspace we can't support kernel addresses that were fed under set_fs(KERNEL_DS) from bpf-cgroup. Signed-off-by: Christoph Hellwig <[email protected]> --- net/bpfilter/bpfilter_kern.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/bpfilter/bpfilter_kern.c b/net/bpfilter/bpfilter_kern.c index 2c31e82cb953af..977e9dad72ca4f 100644 --- a/net/bpfilter/bpfilter_kern.c +++ b/net/bpfilter/bpfilter_kern.c @@ -41,6 +41,11 @@ static int __bpfilter_process_sockopt(struct sock *sk, int optname, ssize_t n; int ret = -EFAULT; + if (uaccess_kernel()) { + pr_err("kernel access not supported\n"); + return -EFAULT; + } + req.is_set = is_set; req.pid = current->pid; req.cmd = optname; -- 2.27.0