[net-next-2.6.git] / net / core / filter.c

/*
 * Linux Socket Filter - Kernel level socket filtering
 *
 * Author:
 *     Jay Schulist <jschlst@samba.org>
 *
 * Based on the design of:
 *     - The Berkeley Packet Filter
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 *
 * Andi Kleen - Fix a few bad bugs and races.
 * Kris Katterjohn - Added many additional checks in sk_chk_filter()
 */

#include <linux/module.h>
#include <linux/types.h>
#include <linux/mm.h>
#include <linux/fcntl.h>
#include <linux/socket.h>
#include <linux/in.h>
#include <linux/inet.h>
#include <linux/netdevice.h>
#include <linux/if_packet.h>
#include <linux/gfp.h>
#include <net/ip.h>
#include <net/protocol.h>
#include <net/netlink.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <linux/errno.h>
#include <linux/timer.h>
#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>
#include <linux/filter.h>

/* No hurry in this branch */
static void *__load_pointer(struct sk_buff *skb, int k)
{
	u8 *ptr = NULL;

	if (k >= SKF_NET_OFF)
		ptr = skb_network_header(skb) + k - SKF_NET_OFF;
	else if (k >= SKF_LL_OFF)
		ptr = skb_mac_header(skb) + k - SKF_LL_OFF;

	if (ptr >= skb->head && ptr < skb_tail_pointer(skb))
		return ptr;
	return NULL;
}

static inline void *load_pointer(struct sk_buff *skb, int k,
				 unsigned int size, void *buffer)
{
	if (k >= 0)
		return skb_header_pointer(skb, k, size, buffer);
	else {
		if (k >= SKF_AD_OFF)
			return NULL;
		return __load_pointer(skb, k);
	}
}

/**
 *	sk_filter - run a packet through a socket filter
 *	@sk: sock associated with &sk_buff
 *	@skb: buffer to filter
 *
 * Run the filter code and then cut skb->data to correct size returned by
 * sk_run_filter. If pkt_len is 0 we toss packet. If skb->len is smaller
 * than pkt_len we keep whole skb->data. This is the socket level
 * wrapper to sk_run_filter. It returns 0 if the packet should
 * be accepted or -EPERM if the packet should be tossed.
 *
 */
int sk_filter(struct sock *sk, struct sk_buff *skb)
{
	int err;
	struct sk_filter *filter;

	err = security_sock_rcv_skb(sk, skb);
	if (err)
		return err;

	rcu_read_lock_bh();
	filter = rcu_dereference_bh(sk->sk_filter);
	if (filter) {
		unsigned int pkt_len = sk_run_filter(skb, filter->insns, filter->len);

		err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM;
	}
	rcu_read_unlock_bh();

	return err;
}
EXPORT_SYMBOL(sk_filter);

/**
 *	sk_run_filter - run a filter on a socket
 *	@skb: buffer to run the filter on
 *	@filter: filter to apply
 *	@flen: length of filter
 *
 * Decode and apply filter instructions to the skb->data.
 * Return length to keep, 0 for none. skb is the data we are
 * filtering, filter is the array of filter instructions, and
 * len is the number of filter blocks in the array.
 */
unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
{
	void *ptr;
	u32 A = 0;			/* Accumulator */
	u32 X = 0;			/* Index Register */
	u32 mem[BPF_MEMWORDS];		/* Scratch Memory Store */
	unsigned long memvalid = 0;
	u32 tmp;
	int k;
	int pc;

	BUILD_BUG_ON(BPF_MEMWORDS > BITS_PER_LONG);
	/*
	 * Process array of filter instructions.
	 */
	for (pc = 0; pc < flen; pc++) {
		const struct sock_filter *fentry = &filter[pc];
		u32 f_k = fentry->k;

		switch (fentry->code) {
		case BPF_S_ALU_ADD_X:
			A += X;
			continue;
		case BPF_S_ALU_ADD_K:
			A += f_k;
			continue;
		case BPF_S_ALU_SUB_X:
			A -= X;
			continue;
		case BPF_S_ALU_SUB_K:
			A -= f_k;
			continue;
		case BPF_S_ALU_MUL_X:
			A *= X;
			continue;
		case BPF_S_ALU_MUL_K:
			A *= f_k;
			continue;
		case BPF_S_ALU_DIV_X:
			if (X == 0)
				return 0;
			A /= X;
			continue;
		case BPF_S_ALU_DIV_K:
			A /= f_k;
			continue;
		case BPF_S_ALU_AND_X:
			A &= X;
			continue;
		case BPF_S_ALU_AND_K:
			A &= f_k;
			continue;
		case BPF_S_ALU_OR_X:
			A |= X;
			continue;
		case BPF_S_ALU_OR_K:
			A |= f_k;
			continue;
		case BPF_S_ALU_LSH_X:
			A <<= X;
			continue;
		case BPF_S_ALU_LSH_K:
			A <<= f_k;
			continue;
		case BPF_S_ALU_RSH_X:
			A >>= X;
			continue;
		case BPF_S_ALU_RSH_K:
			A >>= f_k;
			continue;
		case BPF_S_ALU_NEG:
			A = -A;
			continue;
		case BPF_S_JMP_JA:
			pc += f_k;
			continue;
		case BPF_S_JMP_JGT_K:
			pc += (A > f_k) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JGE_K:
			pc += (A >= f_k) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JEQ_K:
			pc += (A == f_k) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JSET_K:
			pc += (A & f_k) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JGT_X:
			pc += (A > X) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JGE_X:
			pc += (A >= X) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JEQ_X:
			pc += (A == X) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JSET_X:
			pc += (A & X) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_LD_W_ABS:
			k = f_k;
load_w:
			ptr = load_pointer(skb, k, 4, &tmp);
			if (ptr != NULL) {
				A = get_unaligned_be32(ptr);
				continue;
			}
			break;
		case BPF_S_LD_H_ABS:
			k = f_k;
load_h:
			ptr = load_pointer(skb, k, 2, &tmp);
			if (ptr != NULL) {
				A = get_unaligned_be16(ptr);
				continue;
			}
			break;
		case BPF_S_LD_B_ABS:
			k = f_k;
load_b:
			ptr = load_pointer(skb, k, 1, &tmp);
			if (ptr != NULL) {
				A = *(u8 *)ptr;
				continue;
			}
			break;
		case BPF_S_LD_W_LEN:
			A = skb->len;
			continue;
		case BPF_S_LDX_W_LEN:
			X = skb->len;
			continue;
		case BPF_S_LD_W_IND:
			k = X + f_k;
			goto load_w;
		case BPF_S_LD_H_IND:
			k = X + f_k;
			goto load_h;
		case BPF_S_LD_B_IND:
			k = X + f_k;
			goto load_b;
		case BPF_S_LDX_B_MSH:
			ptr = load_pointer(skb, f_k, 1, &tmp);
			if (ptr != NULL) {
				X = (*(u8 *)ptr & 0xf) << 2;
				continue;
			}
			return 0;
		case BPF_S_LD_IMM:
			A = f_k;
			continue;
		case BPF_S_LDX_IMM:
			X = f_k;
			continue;
		case BPF_S_LD_MEM:
			A = (memvalid & (1UL << f_k)) ?
				mem[f_k] : 0;
			continue;
		case BPF_S_LDX_MEM:
			X = (memvalid & (1UL << f_k)) ?
				mem[f_k] : 0;
			continue;
		case BPF_S_MISC_TAX:
			X = A;
			continue;
		case BPF_S_MISC_TXA:
			A = X;
			continue;
		case BPF_S_RET_K:
			return f_k;
		case BPF_S_RET_A:
			return A;
		case BPF_S_ST:
			memvalid |= 1UL << f_k;
			mem[f_k] = A;
			continue;
		case BPF_S_STX:
			memvalid |= 1UL << f_k;
			mem[f_k] = X;
			continue;
		default:
			WARN_ON(1);
			return 0;
		}

		/*
		 * Handle ancillary data, which are impossible
		 * (or very difficult) to get parsing packet contents.
		 */
		switch (k-SKF_AD_OFF) {
		case SKF_AD_PROTOCOL:
			A = ntohs(skb->protocol);
			continue;
		case SKF_AD_PKTTYPE:
			A = skb->pkt_type;
			continue;
		case SKF_AD_IFINDEX:
			if (!skb->dev)
				return 0;
			A = skb->dev->ifindex;
			continue;
		case SKF_AD_MARK:
			A = skb->mark;
			continue;
		case SKF_AD_QUEUE:
			A = skb->queue_mapping;
			continue;
		case SKF_AD_HATYPE:
			if (!skb->dev)
				return 0;
			A = skb->dev->type;
			continue;
		case SKF_AD_NLATTR: {
			struct nlattr *nla;

			if (skb_is_nonlinear(skb))
				return 0;
			if (A > skb->len - sizeof(struct nlattr))
				return 0;

			nla = nla_find((struct nlattr *)&skb->data[A],
				       skb->len - A, X);
			if (nla)
				A = (void *)nla - (void *)skb->data;
			else
				A = 0;
			continue;
		}
		case SKF_AD_NLATTR_NEST: {
			struct nlattr *nla;

			if (skb_is_nonlinear(skb))
				return 0;
			if (A > skb->len - sizeof(struct nlattr))
				return 0;

			nla = (struct nlattr *)&skb->data[A];
			if (nla->nla_len > A - skb->len)
				return 0;

			nla = nla_find_nested(nla, X);
			if (nla)
				A = (void *)nla - (void *)skb->data;
			else
				A = 0;
			continue;
		}
		default:
			return 0;
		}
	}

	return 0;
}
EXPORT_SYMBOL(sk_run_filter);

/**
 *	sk_chk_filter - verify socket filter code
 *	@filter: filter to verify
 *	@flen: length of filter
 *
 * Check the user's filter code. If we let some ugly
 * filter code slip through kaboom! The filter must contain
 * no references or jumps that are out of range, no illegal
 * instructions, and must end with a RET instruction.
 *
 * All jumps are forward as they are not signed.
 *
 * Returns 0 if the rule set is legal or -EINVAL if not.
 */
int sk_chk_filter(struct sock_filter *filter, int flen)
{
	struct sock_filter *ftest;
	int pc;

	if (flen == 0 || flen > BPF_MAXINSNS)
		return -EINVAL;

	/* check the filter code now */
	for (pc = 0; pc < flen; pc++) {
		ftest = &filter[pc];

		/* Only allow valid instructions */
		switch (ftest->code) {
		case BPF_ALU|BPF_ADD|BPF_K:
			ftest->code = BPF_S_ALU_ADD_K;
			break;
		case BPF_ALU|BPF_ADD|BPF_X:
			ftest->code = BPF_S_ALU_ADD_X;
			break;
		case BPF_ALU|BPF_SUB|BPF_K:
			ftest->code = BPF_S_ALU_SUB_K;
			break;
		case BPF_ALU|BPF_SUB|BPF_X:
			ftest->code = BPF_S_ALU_SUB_X;
			break;
		case BPF_ALU|BPF_MUL|BPF_K:
			ftest->code = BPF_S_ALU_MUL_K;
			break;
		case BPF_ALU|BPF_MUL|BPF_X:
			ftest->code = BPF_S_ALU_MUL_X;
			break;
		case BPF_ALU|BPF_DIV|BPF_X:
			ftest->code = BPF_S_ALU_DIV_X;
			break;
		case BPF_ALU|BPF_AND|BPF_K:
			ftest->code = BPF_S_ALU_AND_K;
			break;
		case BPF_ALU|BPF_AND|BPF_X:
			ftest->code = BPF_S_ALU_AND_X;
			break;
		case BPF_ALU|BPF_OR|BPF_K:
			ftest->code = BPF_S_ALU_OR_K;
			break;
		case BPF_ALU|BPF_OR|BPF_X:
			ftest->code = BPF_S_ALU_OR_X;
			break;
		case BPF_ALU|BPF_LSH|BPF_K:
			ftest->code = BPF_S_ALU_LSH_K;
			break;
		case BPF_ALU|BPF_LSH|BPF_X:
			ftest->code = BPF_S_ALU_LSH_X;
			break;
		case BPF_ALU|BPF_RSH|BPF_K:
			ftest->code = BPF_S_ALU_RSH_K;
			break;
		case BPF_ALU|BPF_RSH|BPF_X:
			ftest->code = BPF_S_ALU_RSH_X;
			break;
		case BPF_ALU|BPF_NEG:
			ftest->code = BPF_S_ALU_NEG;
			break;
		case BPF_LD|BPF_W|BPF_ABS:
			ftest->code = BPF_S_LD_W_ABS;
			break;
		case BPF_LD|BPF_H|BPF_ABS:
			ftest->code = BPF_S_LD_H_ABS;
			break;
		case BPF_LD|BPF_B|BPF_ABS:
			ftest->code = BPF_S_LD_B_ABS;
			break;
		case BPF_LD|BPF_W|BPF_LEN:
			ftest->code = BPF_S_LD_W_LEN;
			break;
		case BPF_LD|BPF_W|BPF_IND:
			ftest->code = BPF_S_LD_W_IND;
			break;
		case BPF_LD|BPF_H|BPF_IND:
			ftest->code = BPF_S_LD_H_IND;
			break;
		case BPF_LD|BPF_B|BPF_IND:
			ftest->code = BPF_S_LD_B_IND;
			break;
		case BPF_LD|BPF_IMM:
			ftest->code = BPF_S_LD_IMM;
			break;
		case BPF_LDX|BPF_W|BPF_LEN:
			ftest->code = BPF_S_LDX_W_LEN;
			break;
		case BPF_LDX|BPF_B|BPF_MSH:
			ftest->code = BPF_S_LDX_B_MSH;
			break;
		case BPF_LDX|BPF_IMM:
			ftest->code = BPF_S_LDX_IMM;
			break;
		case BPF_MISC|BPF_TAX:
			ftest->code = BPF_S_MISC_TAX;
			break;
		case BPF_MISC|BPF_TXA:
			ftest->code = BPF_S_MISC_TXA;
			break;
		case BPF_RET|BPF_K:
			ftest->code = BPF_S_RET_K;
			break;
		case BPF_RET|BPF_A:
			ftest->code = BPF_S_RET_A;
			break;

		/* Some instructions need special checks */

			/* check for division by zero */
		case BPF_ALU|BPF_DIV|BPF_K:
			if (ftest->k == 0)
				return -EINVAL;
			ftest->code = BPF_S_ALU_DIV_K;
			break;

		/* check for invalid memory addresses */
		case BPF_LD|BPF_MEM:
			if (ftest->k >= BPF_MEMWORDS)
				return -EINVAL;
			ftest->code = BPF_S_LD_MEM;
			break;
		case BPF_LDX|BPF_MEM:
			if (ftest->k >= BPF_MEMWORDS)
				return -EINVAL;
			ftest->code = BPF_S_LDX_MEM;
			break;
		case BPF_ST:
			if (ftest->k >= BPF_MEMWORDS)
				return -EINVAL;
			ftest->code = BPF_S_ST;
			break;
		case BPF_STX:
			if (ftest->k >= BPF_MEMWORDS)
				return -EINVAL;
			ftest->code = BPF_S_STX;
			break;

		case BPF_JMP|BPF_JA:
			/*
			 * Note, the large ftest->k might cause loops.
			 * Compare this with conditional jumps below,
			 * where offsets are limited. --ANK (981016)
			 */
			if (ftest->k >= (unsigned)(flen-pc-1))
				return -EINVAL;
			ftest->code = BPF_S_JMP_JA;
			break;

		case BPF_JMP|BPF_JEQ|BPF_K:
			ftest->code = BPF_S_JMP_JEQ_K;
			break;
		case BPF_JMP|BPF_JEQ|BPF_X:
			ftest->code = BPF_S_JMP_JEQ_X;
			break;
		case BPF_JMP|BPF_JGE|BPF_K:
			ftest->code = BPF_S_JMP_JGE_K;
			break;
		case BPF_JMP|BPF_JGE|BPF_X:
			ftest->code = BPF_S_JMP_JGE_X;
			break;
		case BPF_JMP|BPF_JGT|BPF_K:
			ftest->code = BPF_S_JMP_JGT_K;
			break;
		case BPF_JMP|BPF_JGT|BPF_X:
			ftest->code = BPF_S_JMP_JGT_X;
			break;
		case BPF_JMP|BPF_JSET|BPF_K:
			ftest->code = BPF_S_JMP_JSET_K;
			break;
		case BPF_JMP|BPF_JSET|BPF_X:
			ftest->code = BPF_S_JMP_JSET_X;
			break;

		default:
			return -EINVAL;
		}

			/* for conditionals both must be safe */
		switch (ftest->code) {
		case BPF_S_JMP_JEQ_K:
		case BPF_S_JMP_JEQ_X:
		case BPF_S_JMP_JGE_K:
		case BPF_S_JMP_JGE_X:
		case BPF_S_JMP_JGT_K:
		case BPF_S_JMP_JGT_X:
		case BPF_S_JMP_JSET_X:
		case BPF_S_JMP_JSET_K:
			if (pc + ftest->jt + 1 >= flen ||
			    pc + ftest->jf + 1 >= flen)
				return -EINVAL;
		}
	}

	/* last instruction must be a RET code */
	switch (filter[flen - 1].code) {
	case BPF_S_RET_K:
	case BPF_S_RET_A:
		return 0;
		break;
		default:
			return -EINVAL;
		}
}
EXPORT_SYMBOL(sk_chk_filter);

/**
 * 	sk_filter_rcu_release - Release a socket filter by rcu_head
 *	@rcu: rcu_head that contains the sk_filter to free
 */
static void sk_filter_rcu_release(struct rcu_head *rcu)
{
	struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);

	sk_filter_release(fp);
}

static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp)
{
	unsigned int size = sk_filter_len(fp);

	atomic_sub(size, &sk->sk_omem_alloc);
	call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
}

/**
 *	sk_attach_filter - attach a socket filter
 *	@fprog: the filter program
 *	@sk: the socket to use
 *
 * Attach the user's filter code. We first run some sanity checks on
 * it to make sure it does not explode on us later. If an error
 * occurs or there is insufficient memory for the filter a negative
 * errno code is returned. On success the return is zero.
 */
int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
{
	struct sk_filter *fp, *old_fp;
	unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
	int err;

	/* Make sure new filter is there and in the right amounts. */
	if (fprog->filter == NULL)
		return -EINVAL;

	fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
	if (!fp)
		return -ENOMEM;
	if (copy_from_user(fp->insns, fprog->filter, fsize)) {
		sock_kfree_s(sk, fp, fsize+sizeof(*fp));
		return -EFAULT;
	}

	atomic_set(&fp->refcnt, 1);
	fp->len = fprog->len;

	err = sk_chk_filter(fp->insns, fp->len);
	if (err) {
		sk_filter_uncharge(sk, fp);
		return err;
	}

	old_fp = rcu_dereference_protected(sk->sk_filter,
					   sock_owned_by_user(sk));
	rcu_assign_pointer(sk->sk_filter, fp);

	if (old_fp)
		sk_filter_delayed_uncharge(sk, old_fp);
	return 0;
}
EXPORT_SYMBOL_GPL(sk_attach_filter);

int sk_detach_filter(struct sock *sk)
{
	int ret = -ENOENT;
	struct sk_filter *filter;

	filter = rcu_dereference_protected(sk->sk_filter,
					   sock_owned_by_user(sk));
	if (filter) {
		rcu_assign_pointer(sk->sk_filter, NULL);
		sk_filter_delayed_uncharge(sk, filter);
		ret = 0;
	}
	return ret;
}
EXPORT_SYMBOL_GPL(sk_detach_filter);
Commit	Line	Data
1da177e4 LT	1	/*
	2	* Linux Socket Filter - Kernel level socket filtering
	3	*
	4	* Author:
	5	* Jay Schulist <jschlst@samba.org>
	6	*
	7	* Based on the design of:
	8	* - The Berkeley Packet Filter
	9	*
	10	* This program is free software; you can redistribute it and/or
	11	* modify it under the terms of the GNU General Public License
	12	* as published by the Free Software Foundation; either version
	13	* 2 of the License, or (at your option) any later version.
	14	*
	15	* Andi Kleen - Fix a few bad bugs and races.
93699863	16	* Kris Katterjohn - Added many additional checks in sk_chk_filter()
1da177e4 LT	17	*/
	18
	19	#include <linux/module.h>
	20	#include <linux/types.h>
1da177e4 LT	21	#include <linux/mm.h>
	22	#include <linux/fcntl.h>
	23	#include <linux/socket.h>
	24	#include <linux/in.h>
	25	#include <linux/inet.h>
	26	#include <linux/netdevice.h>
	27	#include <linux/if_packet.h>
5a0e3ad6	28	#include <linux/gfp.h>
1da177e4 LT	29	#include <net/ip.h>
1da177e4 LT	30	#include <net/protocol.h>
4738c1db	31	#include <net/netlink.h>
1da177e4 LT	32	#include <linux/skbuff.h>
	33	#include <net/sock.h>
	34	#include <linux/errno.h>
	35	#include <linux/timer.h>
	36	#include <asm/system.h>
	37	#include <asm/uaccess.h>
40daafc8	38	#include <asm/unaligned.h>
1da177e4 LT	39	#include <linux/filter.h>
	40
	41	/* No hurry in this branch */
0b05b2a4	42	static void __load_pointer(struct sk_buff skb, int k)
1da177e4 LT	43	{
	44	u8 *ptr = NULL;
	45
	46	if (k >= SKF_NET_OFF)
d56f90a7	47	ptr = skb_network_header(skb) + k - SKF_NET_OFF;
1da177e4	48	else if (k >= SKF_LL_OFF)
98e399f8	49	ptr = skb_mac_header(skb) + k - SKF_LL_OFF;
1da177e4	50
27a884dc	51	if (ptr >= skb->head && ptr < skb_tail_pointer(skb))
1da177e4 LT	52	return ptr;
	53	return NULL;
	54	}
	55
0b05b2a4	56	static inline void load_pointer(struct sk_buff skb, int k,
4ec93edb	57	unsigned int size, void *buffer)
0b05b2a4 PM	58	{
	59	if (k >= 0)
	60	return skb_header_pointer(skb, k, size, buffer);
	61	else {
	62	if (k >= SKF_AD_OFF)
	63	return NULL;
	64	return __load_pointer(skb, k);
	65	}
	66	}
	67
43db6d65 SH	68	/**
	69	* sk_filter - run a packet through a socket filter
	70	* @sk: sock associated with &sk_buff
	71	* @skb: buffer to filter
43db6d65 SH	72	*
	73	* Run the filter code and then cut skb->data to correct size returned by
	74	* sk_run_filter. If pkt_len is 0 we toss packet. If skb->len is smaller
	75	* than pkt_len we keep whole skb->data. This is the socket level
	76	* wrapper to sk_run_filter. It returns 0 if the packet should
	77	* be accepted or -EPERM if the packet should be tossed.
	78	*
	79	*/
	80	int sk_filter(struct sock sk, struct sk_buff skb)
	81	{
	82	int err;
	83	struct sk_filter *filter;
	84
	85	err = security_sock_rcv_skb(sk, skb);
	86	if (err)
	87	return err;
	88
	89	rcu_read_lock_bh();
a898def2	90	filter = rcu_dereference_bh(sk->sk_filter);
43db6d65	91	if (filter) {
0d7da9dd ED	92	unsigned int pkt_len = sk_run_filter(skb, filter->insns, filter->len);
0d7da9dd ED	93
43db6d65 SH	94	err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM;
	95	}
	96	rcu_read_unlock_bh();
	97
	98	return err;
	99	}
	100	EXPORT_SYMBOL(sk_filter);
	101
1da177e4	102	/**
2966b66c	103	* sk_run_filter - run a filter on a socket
1da177e4 LT	104	* @skb: buffer to run the filter on
	105	* @filter: filter to apply
	106	* @flen: length of filter
	107	*
	108	* Decode and apply filter instructions to the skb->data.
	109	* Return length to keep, 0 for none. skb is the data we are
	110	* filtering, filter is the array of filter instructions, and
	111	* len is the number of filter blocks in the array.
	112	*/
4bad4dc9	113	unsigned int sk_run_filter(struct sk_buff skb, struct sock_filter filter, int flen)
1da177e4	114	{
0b05b2a4	115	void *ptr;
2966b66c KK	116	u32 A = 0; /* Accumulator */
2966b66c KK	117	u32 X = 0; /* Index Register */
1da177e4	118	u32 mem[BPF_MEMWORDS]; /* Scratch Memory Store */
57fe93b3	119	unsigned long memvalid = 0;
0b05b2a4	120	u32 tmp;
1da177e4 LT	121	int k;
	122	int pc;
	123
57fe93b3	124	BUILD_BUG_ON(BPF_MEMWORDS > BITS_PER_LONG);
1da177e4 LT	125	/*
	126	* Process array of filter instructions.
	127	*/
	128	for (pc = 0; pc < flen; pc++) {
57fe93b3 DM	129	const struct sock_filter *fentry = &filter[pc];
57fe93b3 DM	130	u32 f_k = fentry->k;
4ec93edb	131
1da177e4	132	switch (fentry->code) {
01f2f3f6	133	case BPF_S_ALU_ADD_X:
1da177e4 LT	134	A += X;
1da177e4 LT	135	continue;
01f2f3f6	136	case BPF_S_ALU_ADD_K:
57fe93b3	137	A += f_k;
1da177e4	138	continue;
01f2f3f6	139	case BPF_S_ALU_SUB_X:
1da177e4 LT	140	A -= X;
1da177e4 LT	141	continue;
01f2f3f6	142	case BPF_S_ALU_SUB_K:
57fe93b3	143	A -= f_k;
1da177e4	144	continue;
01f2f3f6	145	case BPF_S_ALU_MUL_X:
1da177e4 LT	146	A *= X;
1da177e4 LT	147	continue;
01f2f3f6	148	case BPF_S_ALU_MUL_K:
57fe93b3	149	A *= f_k;
1da177e4	150	continue;
01f2f3f6	151	case BPF_S_ALU_DIV_X:
1da177e4 LT	152	if (X == 0)
	153	return 0;
	154	A /= X;
	155	continue;
01f2f3f6	156	case BPF_S_ALU_DIV_K:
57fe93b3	157	A /= f_k;
1da177e4	158	continue;
01f2f3f6	159	case BPF_S_ALU_AND_X:
1da177e4 LT	160	A &= X;
1da177e4 LT	161	continue;
01f2f3f6	162	case BPF_S_ALU_AND_K:
57fe93b3	163	A &= f_k;
1da177e4	164	continue;
01f2f3f6	165	case BPF_S_ALU_OR_X:
1da177e4 LT	166	A \|= X;
1da177e4 LT	167	continue;
01f2f3f6	168	case BPF_S_ALU_OR_K:
57fe93b3	169	A \|= f_k;
1da177e4	170	continue;
01f2f3f6	171	case BPF_S_ALU_LSH_X:
1da177e4 LT	172	A <<= X;
1da177e4 LT	173	continue;
01f2f3f6	174	case BPF_S_ALU_LSH_K:
57fe93b3	175	A <<= f_k;
1da177e4	176	continue;
01f2f3f6	177	case BPF_S_ALU_RSH_X:
1da177e4 LT	178	A >>= X;
1da177e4 LT	179	continue;
01f2f3f6	180	case BPF_S_ALU_RSH_K:
57fe93b3	181	A >>= f_k;
1da177e4	182	continue;
01f2f3f6	183	case BPF_S_ALU_NEG:
1da177e4 LT	184	A = -A;
1da177e4 LT	185	continue;
01f2f3f6	186	case BPF_S_JMP_JA:
57fe93b3	187	pc += f_k;
1da177e4	188	continue;
01f2f3f6	189	case BPF_S_JMP_JGT_K:
57fe93b3	190	pc += (A > f_k) ? fentry->jt : fentry->jf;
1da177e4	191	continue;
01f2f3f6	192	case BPF_S_JMP_JGE_K:
57fe93b3	193	pc += (A >= f_k) ? fentry->jt : fentry->jf;
1da177e4	194	continue;
01f2f3f6	195	case BPF_S_JMP_JEQ_K:
57fe93b3	196	pc += (A == f_k) ? fentry->jt : fentry->jf;
1da177e4	197	continue;
01f2f3f6	198	case BPF_S_JMP_JSET_K:
57fe93b3	199	pc += (A & f_k) ? fentry->jt : fentry->jf;
1da177e4	200	continue;
01f2f3f6	201	case BPF_S_JMP_JGT_X:
1da177e4 LT	202	pc += (A > X) ? fentry->jt : fentry->jf;
1da177e4 LT	203	continue;
01f2f3f6	204	case BPF_S_JMP_JGE_X:
1da177e4 LT	205	pc += (A >= X) ? fentry->jt : fentry->jf;
1da177e4 LT	206	continue;
01f2f3f6	207	case BPF_S_JMP_JEQ_X:
1da177e4 LT	208	pc += (A == X) ? fentry->jt : fentry->jf;
1da177e4 LT	209	continue;
01f2f3f6	210	case BPF_S_JMP_JSET_X:
1da177e4 LT	211	pc += (A & X) ? fentry->jt : fentry->jf;
1da177e4 LT	212	continue;
01f2f3f6	213	case BPF_S_LD_W_ABS:
57fe93b3	214	k = f_k;
e35bedf3	215	load_w:
0b05b2a4 PM	216	ptr = load_pointer(skb, k, 4, &tmp);
0b05b2a4 PM	217	if (ptr != NULL) {
d3e2ce3b	218	A = get_unaligned_be32(ptr);
0b05b2a4	219	continue;
1da177e4	220	}
1198ad00	221	break;
01f2f3f6	222	case BPF_S_LD_H_ABS:
57fe93b3	223	k = f_k;
e35bedf3	224	load_h:
0b05b2a4 PM	225	ptr = load_pointer(skb, k, 2, &tmp);
0b05b2a4 PM	226	if (ptr != NULL) {
d3e2ce3b	227	A = get_unaligned_be16(ptr);
0b05b2a4	228	continue;
1da177e4	229	}
1198ad00	230	break;
01f2f3f6	231	case BPF_S_LD_B_ABS:
57fe93b3	232	k = f_k;
1da177e4	233	load_b:
0b05b2a4 PM	234	ptr = load_pointer(skb, k, 1, &tmp);
	235	if (ptr != NULL) {
	236	A = (u8 )ptr;
	237	continue;
1da177e4	238	}
1198ad00	239	break;
01f2f3f6	240	case BPF_S_LD_W_LEN:
3154e540	241	A = skb->len;
1da177e4	242	continue;
01f2f3f6	243	case BPF_S_LDX_W_LEN:
3154e540	244	X = skb->len;
1da177e4	245	continue;
01f2f3f6	246	case BPF_S_LD_W_IND:
57fe93b3	247	k = X + f_k;
1da177e4	248	goto load_w;
01f2f3f6	249	case BPF_S_LD_H_IND:
57fe93b3	250	k = X + f_k;
1da177e4	251	goto load_h;
01f2f3f6	252	case BPF_S_LD_B_IND:
57fe93b3	253	k = X + f_k;
1da177e4	254	goto load_b;
01f2f3f6	255	case BPF_S_LDX_B_MSH:
57fe93b3	256	ptr = load_pointer(skb, f_k, 1, &tmp);
0b05b2a4 PM	257	if (ptr != NULL) {
	258	X = ((u8 )ptr & 0xf) << 2;
	259	continue;
	260	}
	261	return 0;
01f2f3f6	262	case BPF_S_LD_IMM:
57fe93b3	263	A = f_k;
1da177e4	264	continue;
01f2f3f6	265	case BPF_S_LDX_IMM:
57fe93b3	266	X = f_k;
1da177e4	267	continue;
01f2f3f6	268	case BPF_S_LD_MEM:
57fe93b3 DM	269	A = (memvalid & (1UL << f_k)) ?
57fe93b3 DM	270	mem[f_k] : 0;
1da177e4	271	continue;
01f2f3f6	272	case BPF_S_LDX_MEM:
57fe93b3 DM	273	X = (memvalid & (1UL << f_k)) ?
57fe93b3 DM	274	mem[f_k] : 0;
1da177e4	275	continue;
01f2f3f6	276	case BPF_S_MISC_TAX:
1da177e4 LT	277	X = A;
1da177e4 LT	278	continue;
01f2f3f6	279	case BPF_S_MISC_TXA:
1da177e4 LT	280	A = X;
1da177e4 LT	281	continue;
01f2f3f6	282	case BPF_S_RET_K:
57fe93b3	283	return f_k;
01f2f3f6	284	case BPF_S_RET_A:
4bad4dc9	285	return A;
01f2f3f6	286	case BPF_S_ST:
57fe93b3 DM	287	memvalid \|= 1UL << f_k;
57fe93b3 DM	288	mem[f_k] = A;
1da177e4	289	continue;
01f2f3f6	290	case BPF_S_STX:
57fe93b3 DM	291	memvalid \|= 1UL << f_k;
57fe93b3 DM	292	mem[f_k] = X;
1da177e4 LT	293	continue;
1da177e4 LT	294	default:
93699863	295	WARN_ON(1);
1da177e4 LT	296	return 0;
	297	}
	298
	299	/*
	300	* Handle ancillary data, which are impossible
	301	* (or very difficult) to get parsing packet contents.
	302	*/
	303	switch (k-SKF_AD_OFF) {
	304	case SKF_AD_PROTOCOL:
252e3346	305	A = ntohs(skb->protocol);
1da177e4 LT	306	continue;
	307	case SKF_AD_PKTTYPE:
	308	A = skb->pkt_type;
	309	continue;
	310	case SKF_AD_IFINDEX:
40eaf962 PLE	311	if (!skb->dev)
40eaf962 PLE	312	return 0;
1da177e4 LT	313	A = skb->dev->ifindex;
1da177e4 LT	314	continue;
7e75f93e	315	case SKF_AD_MARK:
	316	A = skb->mark;
	317	continue;
d19742fb ED	318	case SKF_AD_QUEUE:
	319	A = skb->queue_mapping;
	320	continue;
40eaf962 PLE	321	case SKF_AD_HATYPE:
	322	if (!skb->dev)
	323	return 0;
	324	A = skb->dev->type;
	325	continue;
4738c1db PM	326	case SKF_AD_NLATTR: {
	327	struct nlattr *nla;
	328
	329	if (skb_is_nonlinear(skb))
	330	return 0;
	331	if (A > skb->len - sizeof(struct nlattr))
	332	return 0;
	333
	334	nla = nla_find((struct nlattr *)&skb->data[A],
	335	skb->len - A, X);
	336	if (nla)
	337	A = (void )nla - (void )skb->data;
	338	else
	339	A = 0;
	340	continue;
	341	}
d214c753 PNA	342	case SKF_AD_NLATTR_NEST: {
	343	struct nlattr *nla;
	344
	345	if (skb_is_nonlinear(skb))
	346	return 0;
	347	if (A > skb->len - sizeof(struct nlattr))
	348	return 0;
	349
	350	nla = (struct nlattr *)&skb->data[A];
	351	if (nla->nla_len > A - skb->len)
	352	return 0;
	353
	354	nla = nla_find_nested(nla, X);
	355	if (nla)
	356	A = (void )nla - (void )skb->data;
	357	else
	358	A = 0;
	359	continue;
	360	}
1da177e4 LT	361	default:
	362	return 0;
	363	}
	364	}
	365
	366	return 0;
	367	}
b715631f	368	EXPORT_SYMBOL(sk_run_filter);
1da177e4 LT	369
	370	/**
	371	* sk_chk_filter - verify socket filter code
	372	* @filter: filter to verify
	373	* @flen: length of filter
	374	*
	375	* Check the user's filter code. If we let some ugly
	376	* filter code slip through kaboom! The filter must contain
93699863 KK	377	* no references or jumps that are out of range, no illegal
93699863 KK	378	* instructions, and must end with a RET instruction.
1da177e4	379	*
7b11f69f KK	380	* All jumps are forward as they are not signed.
	381	*
	382	* Returns 0 if the rule set is legal or -EINVAL if not.
1da177e4 LT	383	*/
	384	int sk_chk_filter(struct sock_filter *filter, int flen)
	385	{
	386	struct sock_filter *ftest;
	387	int pc;
	388
1b93ae64	389	if (flen == 0 \|\| flen > BPF_MAXINSNS)
1da177e4 LT	390	return -EINVAL;
	391
	392	/* check the filter code now */
	393	for (pc = 0; pc < flen; pc++) {
1da177e4	394	ftest = &filter[pc];
1da177e4	395
93699863 KK	396	/* Only allow valid instructions */
	397	switch (ftest->code) {
	398	case BPF_ALU\|BPF_ADD\|BPF_K:
01f2f3f6 HPP	399	ftest->code = BPF_S_ALU_ADD_K;
01f2f3f6 HPP	400	break;
93699863	401	case BPF_ALU\|BPF_ADD\|BPF_X:
01f2f3f6 HPP	402	ftest->code = BPF_S_ALU_ADD_X;
01f2f3f6 HPP	403	break;
93699863	404	case BPF_ALU\|BPF_SUB\|BPF_K:
01f2f3f6 HPP	405	ftest->code = BPF_S_ALU_SUB_K;
01f2f3f6 HPP	406	break;
93699863	407	case BPF_ALU\|BPF_SUB\|BPF_X:
01f2f3f6 HPP	408	ftest->code = BPF_S_ALU_SUB_X;
01f2f3f6 HPP	409	break;
93699863	410	case BPF_ALU\|BPF_MUL\|BPF_K:
01f2f3f6 HPP	411	ftest->code = BPF_S_ALU_MUL_K;
01f2f3f6 HPP	412	break;
93699863	413	case BPF_ALU\|BPF_MUL\|BPF_X:
01f2f3f6 HPP	414	ftest->code = BPF_S_ALU_MUL_X;
01f2f3f6 HPP	415	break;
93699863	416	case BPF_ALU\|BPF_DIV\|BPF_X:
01f2f3f6 HPP	417	ftest->code = BPF_S_ALU_DIV_X;
01f2f3f6 HPP	418	break;
93699863	419	case BPF_ALU\|BPF_AND\|BPF_K:
01f2f3f6 HPP	420	ftest->code = BPF_S_ALU_AND_K;
01f2f3f6 HPP	421	break;
93699863	422	case BPF_ALU\|BPF_AND\|BPF_X:
01f2f3f6 HPP	423	ftest->code = BPF_S_ALU_AND_X;
01f2f3f6 HPP	424	break;
93699863	425	case BPF_ALU\|BPF_OR\|BPF_K:
01f2f3f6 HPP	426	ftest->code = BPF_S_ALU_OR_K;
01f2f3f6 HPP	427	break;
93699863	428	case BPF_ALU\|BPF_OR\|BPF_X:
01f2f3f6 HPP	429	ftest->code = BPF_S_ALU_OR_X;
01f2f3f6 HPP	430	break;
93699863	431	case BPF_ALU\|BPF_LSH\|BPF_K:
01f2f3f6 HPP	432	ftest->code = BPF_S_ALU_LSH_K;
01f2f3f6 HPP	433	break;
93699863	434	case BPF_ALU\|BPF_LSH\|BPF_X:
01f2f3f6 HPP	435	ftest->code = BPF_S_ALU_LSH_X;
01f2f3f6 HPP	436	break;
93699863	437	case BPF_ALU\|BPF_RSH\|BPF_K:
01f2f3f6 HPP	438	ftest->code = BPF_S_ALU_RSH_K;
01f2f3f6 HPP	439	break;
93699863	440	case BPF_ALU\|BPF_RSH\|BPF_X:
01f2f3f6 HPP	441	ftest->code = BPF_S_ALU_RSH_X;
01f2f3f6 HPP	442	break;
93699863	443	case BPF_ALU\|BPF_NEG:
01f2f3f6 HPP	444	ftest->code = BPF_S_ALU_NEG;
01f2f3f6 HPP	445	break;
93699863	446	case BPF_LD\|BPF_W\|BPF_ABS:
01f2f3f6 HPP	447	ftest->code = BPF_S_LD_W_ABS;
01f2f3f6 HPP	448	break;
93699863	449	case BPF_LD\|BPF_H\|BPF_ABS:
01f2f3f6 HPP	450	ftest->code = BPF_S_LD_H_ABS;
01f2f3f6 HPP	451	break;
93699863	452	case BPF_LD\|BPF_B\|BPF_ABS:
01f2f3f6 HPP	453	ftest->code = BPF_S_LD_B_ABS;
01f2f3f6 HPP	454	break;
93699863	455	case BPF_LD\|BPF_W\|BPF_LEN:
01f2f3f6 HPP	456	ftest->code = BPF_S_LD_W_LEN;
01f2f3f6 HPP	457	break;
93699863	458	case BPF_LD\|BPF_W\|BPF_IND:
01f2f3f6 HPP	459	ftest->code = BPF_S_LD_W_IND;
01f2f3f6 HPP	460	break;
93699863	461	case BPF_LD\|BPF_H\|BPF_IND:
01f2f3f6 HPP	462	ftest->code = BPF_S_LD_H_IND;
01f2f3f6 HPP	463	break;
93699863	464	case BPF_LD\|BPF_B\|BPF_IND:
01f2f3f6 HPP	465	ftest->code = BPF_S_LD_B_IND;
01f2f3f6 HPP	466	break;
93699863	467	case BPF_LD\|BPF_IMM:
01f2f3f6 HPP	468	ftest->code = BPF_S_LD_IMM;
01f2f3f6 HPP	469	break;
93699863	470	case BPF_LDX\|BPF_W\|BPF_LEN:
01f2f3f6 HPP	471	ftest->code = BPF_S_LDX_W_LEN;
01f2f3f6 HPP	472	break;
93699863	473	case BPF_LDX\|BPF_B\|BPF_MSH:
01f2f3f6 HPP	474	ftest->code = BPF_S_LDX_B_MSH;
01f2f3f6 HPP	475	break;
93699863	476	case BPF_LDX\|BPF_IMM:
01f2f3f6 HPP	477	ftest->code = BPF_S_LDX_IMM;
01f2f3f6 HPP	478	break;
93699863	479	case BPF_MISC\|BPF_TAX:
01f2f3f6 HPP	480	ftest->code = BPF_S_MISC_TAX;
01f2f3f6 HPP	481	break;
93699863	482	case BPF_MISC\|BPF_TXA:
01f2f3f6 HPP	483	ftest->code = BPF_S_MISC_TXA;
01f2f3f6 HPP	484	break;
93699863	485	case BPF_RET\|BPF_K:
01f2f3f6 HPP	486	ftest->code = BPF_S_RET_K;
01f2f3f6 HPP	487	break;
93699863	488	case BPF_RET\|BPF_A:
01f2f3f6	489	ftest->code = BPF_S_RET_A;
93699863 KK	490	break;
	491
	492	/* Some instructions need special checks */
fb0d366b	493
93699863	494	/* check for division by zero */
01f2f3f6	495	case BPF_ALU\|BPF_DIV\|BPF_K:
93699863	496	if (ftest->k == 0)
1da177e4	497	return -EINVAL;
01f2f3f6	498	ftest->code = BPF_S_ALU_DIV_K;
93699863 KK	499	break;
93699863 KK	500
01f2f3f6	501	/* check for invalid memory addresses */
93699863	502	case BPF_LD\|BPF_MEM:
01f2f3f6 HPP	503	if (ftest->k >= BPF_MEMWORDS)
	504	return -EINVAL;
	505	ftest->code = BPF_S_LD_MEM;
	506	break;
93699863	507	case BPF_LDX\|BPF_MEM:
01f2f3f6 HPP	508	if (ftest->k >= BPF_MEMWORDS)
	509	return -EINVAL;
	510	ftest->code = BPF_S_LDX_MEM;
	511	break;
93699863	512	case BPF_ST:
01f2f3f6 HPP	513	if (ftest->k >= BPF_MEMWORDS)
	514	return -EINVAL;
	515	ftest->code = BPF_S_ST;
	516	break;
93699863	517	case BPF_STX:
93699863 KK	518	if (ftest->k >= BPF_MEMWORDS)
93699863 KK	519	return -EINVAL;
01f2f3f6	520	ftest->code = BPF_S_STX;
93699863 KK	521	break;
	522
	523	case BPF_JMP\|BPF_JA:
	524	/*
	525	* Note, the large ftest->k might cause loops.
	526	* Compare this with conditional jumps below,
	527	* where offsets are limited. --ANK (981016)
	528	*/
	529	if (ftest->k >= (unsigned)(flen-pc-1))
	530	return -EINVAL;
01f2f3f6	531	ftest->code = BPF_S_JMP_JA;
93699863 KK	532	break;
	533
	534	case BPF_JMP\|BPF_JEQ\|BPF_K:
01f2f3f6 HPP	535	ftest->code = BPF_S_JMP_JEQ_K;
01f2f3f6 HPP	536	break;
93699863	537	case BPF_JMP\|BPF_JEQ\|BPF_X:
01f2f3f6 HPP	538	ftest->code = BPF_S_JMP_JEQ_X;
01f2f3f6 HPP	539	break;
93699863	540	case BPF_JMP\|BPF_JGE\|BPF_K:
01f2f3f6 HPP	541	ftest->code = BPF_S_JMP_JGE_K;
01f2f3f6 HPP	542	break;
93699863	543	case BPF_JMP\|BPF_JGE\|BPF_X:
01f2f3f6 HPP	544	ftest->code = BPF_S_JMP_JGE_X;
01f2f3f6 HPP	545	break;
93699863	546	case BPF_JMP\|BPF_JGT\|BPF_K:
01f2f3f6 HPP	547	ftest->code = BPF_S_JMP_JGT_K;
01f2f3f6 HPP	548	break;
93699863	549	case BPF_JMP\|BPF_JGT\|BPF_X:
01f2f3f6 HPP	550	ftest->code = BPF_S_JMP_JGT_X;
01f2f3f6 HPP	551	break;
93699863	552	case BPF_JMP\|BPF_JSET\|BPF_K:
01f2f3f6 HPP	553	ftest->code = BPF_S_JMP_JSET_K;
01f2f3f6 HPP	554	break;
93699863	555	case BPF_JMP\|BPF_JSET\|BPF_X:
01f2f3f6 HPP	556	ftest->code = BPF_S_JMP_JSET_X;
	557	break;
	558
	559	default:
	560	return -EINVAL;
	561	}
	562
93699863	563	/* for conditionals both must be safe */
01f2f3f6 HPP	564	switch (ftest->code) {
	565	case BPF_S_JMP_JEQ_K:
	566	case BPF_S_JMP_JEQ_X:
	567	case BPF_S_JMP_JGE_K:
	568	case BPF_S_JMP_JGE_X:
	569	case BPF_S_JMP_JGT_K:
	570	case BPF_S_JMP_JGT_X:
	571	case BPF_S_JMP_JSET_X:
	572	case BPF_S_JMP_JSET_K:
e35bedf3	573	if (pc + ftest->jt + 1 >= flen \|\|
93699863 KK	574	pc + ftest->jf + 1 >= flen)
93699863 KK	575	return -EINVAL;
01f2f3f6 HPP	576	}
01f2f3f6 HPP	577	}
93699863	578
01f2f3f6 HPP	579	/* last instruction must be a RET code */
	580	switch (filter[flen - 1].code) {
	581	case BPF_S_RET_K:
	582	case BPF_S_RET_A:
	583	return 0;
	584	break;
93699863 KK	585	default:
93699863 KK	586	return -EINVAL;
1da177e4	587	}
1da177e4	588	}
b715631f	589	EXPORT_SYMBOL(sk_chk_filter);
1da177e4	590
47e958ea	591	/**
0302b862	592	* sk_filter_rcu_release - Release a socket filter by rcu_head
47e958ea PE	593	* @rcu: rcu_head that contains the sk_filter to free
	594	*/
	595	static void sk_filter_rcu_release(struct rcu_head *rcu)
	596	{
	597	struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
	598
	599	sk_filter_release(fp);
	600	}
	601
	602	static void sk_filter_delayed_uncharge(struct sock sk, struct sk_filter fp)
	603	{
	604	unsigned int size = sk_filter_len(fp);
	605
	606	atomic_sub(size, &sk->sk_omem_alloc);
	607	call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
	608	}
	609
1da177e4 LT	610	/**
	611	* sk_attach_filter - attach a socket filter
	612	* @fprog: the filter program
	613	* @sk: the socket to use
	614	*
	615	* Attach the user's filter code. We first run some sanity checks on
	616	* it to make sure it does not explode on us later. If an error
	617	* occurs or there is insufficient memory for the filter a negative
	618	* errno code is returned. On success the return is zero.
	619	*/
	620	int sk_attach_filter(struct sock_fprog fprog, struct sock sk)
	621	{
d3904b73	622	struct sk_filter fp, old_fp;
1da177e4 LT	623	unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
	624	int err;
	625
	626	/* Make sure new filter is there and in the right amounts. */
e35bedf3 KK	627	if (fprog->filter == NULL)
e35bedf3 KK	628	return -EINVAL;
1da177e4 LT	629
	630	fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
	631	if (!fp)
	632	return -ENOMEM;
	633	if (copy_from_user(fp->insns, fprog->filter, fsize)) {
4ec93edb	634	sock_kfree_s(sk, fp, fsize+sizeof(*fp));
1da177e4 LT	635	return -EFAULT;
	636	}
	637
	638	atomic_set(&fp->refcnt, 1);
	639	fp->len = fprog->len;
	640
	641	err = sk_chk_filter(fp->insns, fp->len);
d3904b73 PE	642	if (err) {
	643	sk_filter_uncharge(sk, fp);
	644	return err;
1da177e4 LT	645	}
1da177e4 LT	646
f91ff5b9 ED	647	old_fp = rcu_dereference_protected(sk->sk_filter,
f91ff5b9 ED	648	sock_owned_by_user(sk));
d3904b73	649	rcu_assign_pointer(sk->sk_filter, fp);
d3904b73	650
9b013e05 OJ	651	if (old_fp)
9b013e05 OJ	652	sk_filter_delayed_uncharge(sk, old_fp);
d3904b73	653	return 0;
1da177e4	654	}
5ff3f073	655	EXPORT_SYMBOL_GPL(sk_attach_filter);
1da177e4	656
55b33325 PE	657	int sk_detach_filter(struct sock *sk)
	658	{
	659	int ret = -ENOENT;
	660	struct sk_filter *filter;
	661
f91ff5b9 ED	662	filter = rcu_dereference_protected(sk->sk_filter,
f91ff5b9 ED	663	sock_owned_by_user(sk));
55b33325 PE	664	if (filter) {
55b33325 PE	665	rcu_assign_pointer(sk->sk_filter, NULL);
47e958ea	666	sk_filter_delayed_uncharge(sk, filter);
55b33325 PE	667	ret = 0;
55b33325 PE	668	}
55b33325 PE	669	return ret;
55b33325 PE	670	}
5ff3f073	671	EXPORT_SYMBOL_GPL(sk_detach_filter);