[net-next-2.6.git] / net / core / filter.c

/*
 * Linux Socket Filter - Kernel level socket filtering
 *
 * Author:
 *     Jay Schulist <jschlst@samba.org>
 *
 * Based on the design of:
 *     - The Berkeley Packet Filter
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 *
 * Andi Kleen - Fix a few bad bugs and races.
 * Kris Katterjohn - Added many additional checks in sk_chk_filter()
 */

#include <linux/module.h>
#include <linux/types.h>
#include <linux/mm.h>
#include <linux/fcntl.h>
#include <linux/socket.h>
#include <linux/in.h>
#include <linux/inet.h>
#include <linux/netdevice.h>
#include <linux/if_packet.h>
#include <linux/gfp.h>
#include <net/ip.h>
#include <net/protocol.h>
#include <net/netlink.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <linux/errno.h>
#include <linux/timer.h>
#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>
#include <linux/filter.h>

enum {
	BPF_S_RET_K = 0,
	BPF_S_RET_A,
	BPF_S_ALU_ADD_K,
	BPF_S_ALU_ADD_X,
	BPF_S_ALU_SUB_K,
	BPF_S_ALU_SUB_X,
	BPF_S_ALU_MUL_K,
	BPF_S_ALU_MUL_X,
	BPF_S_ALU_DIV_X,
	BPF_S_ALU_AND_K,
	BPF_S_ALU_AND_X,
	BPF_S_ALU_OR_K,
	BPF_S_ALU_OR_X,
	BPF_S_ALU_LSH_K,
	BPF_S_ALU_LSH_X,
	BPF_S_ALU_RSH_K,
	BPF_S_ALU_RSH_X,
	BPF_S_ALU_NEG,
	BPF_S_LD_W_ABS,
	BPF_S_LD_H_ABS,
	BPF_S_LD_B_ABS,
	BPF_S_LD_W_LEN,
	BPF_S_LD_W_IND,
	BPF_S_LD_H_IND,
	BPF_S_LD_B_IND,
	BPF_S_LD_IMM,
	BPF_S_LDX_W_LEN,
	BPF_S_LDX_B_MSH,
	BPF_S_LDX_IMM,
	BPF_S_MISC_TAX,
	BPF_S_MISC_TXA,
	BPF_S_ALU_DIV_K,
	BPF_S_LD_MEM,
	BPF_S_LDX_MEM,
	BPF_S_ST,
	BPF_S_STX,
	BPF_S_JMP_JA,
	BPF_S_JMP_JEQ_K,
	BPF_S_JMP_JEQ_X,
	BPF_S_JMP_JGE_K,
	BPF_S_JMP_JGE_X,
	BPF_S_JMP_JGT_K,
	BPF_S_JMP_JGT_X,
	BPF_S_JMP_JSET_K,
	BPF_S_JMP_JSET_X,
};

/* No hurry in this branch */
static void *__load_pointer(struct sk_buff *skb, int k)
{
	u8 *ptr = NULL;

	if (k >= SKF_NET_OFF)
		ptr = skb_network_header(skb) + k - SKF_NET_OFF;
	else if (k >= SKF_LL_OFF)
		ptr = skb_mac_header(skb) + k - SKF_LL_OFF;

	if (ptr >= skb->head && ptr < skb_tail_pointer(skb))
		return ptr;
	return NULL;
}

static inline void *load_pointer(struct sk_buff *skb, int k,
				 unsigned int size, void *buffer)
{
	if (k >= 0)
		return skb_header_pointer(skb, k, size, buffer);
	else {
		if (k >= SKF_AD_OFF)
			return NULL;
		return __load_pointer(skb, k);
	}
}

/**
 *	sk_filter - run a packet through a socket filter
 *	@sk: sock associated with &sk_buff
 *	@skb: buffer to filter
 *
 * Run the filter code and then cut skb->data to correct size returned by
 * sk_run_filter. If pkt_len is 0 we toss packet. If skb->len is smaller
 * than pkt_len we keep whole skb->data. This is the socket level
 * wrapper to sk_run_filter. It returns 0 if the packet should
 * be accepted or -EPERM if the packet should be tossed.
 *
 */
int sk_filter(struct sock *sk, struct sk_buff *skb)
{
	int err;
	struct sk_filter *filter;

	err = security_sock_rcv_skb(sk, skb);
	if (err)
		return err;

	rcu_read_lock_bh();
	filter = rcu_dereference_bh(sk->sk_filter);
	if (filter) {
		unsigned int pkt_len = sk_run_filter(skb, filter->insns, filter->len);

		err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM;
	}
	rcu_read_unlock_bh();

	return err;
}
EXPORT_SYMBOL(sk_filter);

/**
 *	sk_run_filter - run a filter on a socket
 *	@skb: buffer to run the filter on
 *	@filter: filter to apply
 *	@flen: length of filter
 *
 * Decode and apply filter instructions to the skb->data.
 * Return length to keep, 0 for none. skb is the data we are
 * filtering, filter is the array of filter instructions, and
 * len is the number of filter blocks in the array.
 */
unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
{
	void *ptr;
	u32 A = 0;			/* Accumulator */
	u32 X = 0;			/* Index Register */
	u32 mem[BPF_MEMWORDS];		/* Scratch Memory Store */
	unsigned long memvalid = 0;
	u32 tmp;
	int k;
	int pc;

	BUILD_BUG_ON(BPF_MEMWORDS > BITS_PER_LONG);
	/*
	 * Process array of filter instructions.
	 */
	for (pc = 0; pc < flen; pc++) {
		const struct sock_filter *fentry = &filter[pc];
		u32 f_k = fentry->k;

		switch (fentry->code) {
		case BPF_S_ALU_ADD_X:
			A += X;
			continue;
		case BPF_S_ALU_ADD_K:
			A += f_k;
			continue;
		case BPF_S_ALU_SUB_X:
			A -= X;
			continue;
		case BPF_S_ALU_SUB_K:
			A -= f_k;
			continue;
		case BPF_S_ALU_MUL_X:
			A *= X;
			continue;
		case BPF_S_ALU_MUL_K:
			A *= f_k;
			continue;
		case BPF_S_ALU_DIV_X:
			if (X == 0)
				return 0;
			A /= X;
			continue;
		case BPF_S_ALU_DIV_K:
			A /= f_k;
			continue;
		case BPF_S_ALU_AND_X:
			A &= X;
			continue;
		case BPF_S_ALU_AND_K:
			A &= f_k;
			continue;
		case BPF_S_ALU_OR_X:
			A |= X;
			continue;
		case BPF_S_ALU_OR_K:
			A |= f_k;
			continue;
		case BPF_S_ALU_LSH_X:
			A <<= X;
			continue;
		case BPF_S_ALU_LSH_K:
			A <<= f_k;
			continue;
		case BPF_S_ALU_RSH_X:
			A >>= X;
			continue;
		case BPF_S_ALU_RSH_K:
			A >>= f_k;
			continue;
		case BPF_S_ALU_NEG:
			A = -A;
			continue;
		case BPF_S_JMP_JA:
			pc += f_k;
			continue;
		case BPF_S_JMP_JGT_K:
			pc += (A > f_k) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JGE_K:
			pc += (A >= f_k) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JEQ_K:
			pc += (A == f_k) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JSET_K:
			pc += (A & f_k) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JGT_X:
			pc += (A > X) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JGE_X:
			pc += (A >= X) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JEQ_X:
			pc += (A == X) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JSET_X:
			pc += (A & X) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_LD_W_ABS:
			k = f_k;
load_w:
			ptr = load_pointer(skb, k, 4, &tmp);
			if (ptr != NULL) {
				A = get_unaligned_be32(ptr);
				continue;
			}
			break;
		case BPF_S_LD_H_ABS:
			k = f_k;
load_h:
			ptr = load_pointer(skb, k, 2, &tmp);
			if (ptr != NULL) {
				A = get_unaligned_be16(ptr);
				continue;
			}
			break;
		case BPF_S_LD_B_ABS:
			k = f_k;
load_b:
			ptr = load_pointer(skb, k, 1, &tmp);
			if (ptr != NULL) {
				A = *(u8 *)ptr;
				continue;
			}
			break;
		case BPF_S_LD_W_LEN:
			A = skb->len;
			continue;
		case BPF_S_LDX_W_LEN:
			X = skb->len;
			continue;
		case BPF_S_LD_W_IND:
			k = X + f_k;
			goto load_w;
		case BPF_S_LD_H_IND:
			k = X + f_k;
			goto load_h;
		case BPF_S_LD_B_IND:
			k = X + f_k;
			goto load_b;
		case BPF_S_LDX_B_MSH:
			ptr = load_pointer(skb, f_k, 1, &tmp);
			if (ptr != NULL) {
				X = (*(u8 *)ptr & 0xf) << 2;
				continue;
			}
			return 0;
		case BPF_S_LD_IMM:
			A = f_k;
			continue;
		case BPF_S_LDX_IMM:
			X = f_k;
			continue;
		case BPF_S_LD_MEM:
			A = (memvalid & (1UL << f_k)) ?
				mem[f_k] : 0;
			continue;
		case BPF_S_LDX_MEM:
			X = (memvalid & (1UL << f_k)) ?
				mem[f_k] : 0;
			continue;
		case BPF_S_MISC_TAX:
			X = A;
			continue;
		case BPF_S_MISC_TXA:
			A = X;
			continue;
		case BPF_S_RET_K:
			return f_k;
		case BPF_S_RET_A:
			return A;
		case BPF_S_ST:
			memvalid |= 1UL << f_k;
			mem[f_k] = A;
			continue;
		case BPF_S_STX:
			memvalid |= 1UL << f_k;
			mem[f_k] = X;
			continue;
		default:
			WARN_ON(1);
			return 0;
		}

		/*
		 * Handle ancillary data, which are impossible
		 * (or very difficult) to get parsing packet contents.
		 */
		switch (k-SKF_AD_OFF) {
		case SKF_AD_PROTOCOL:
			A = ntohs(skb->protocol);
			continue;
		case SKF_AD_PKTTYPE:
			A = skb->pkt_type;
			continue;
		case SKF_AD_IFINDEX:
			if (!skb->dev)
				return 0;
			A = skb->dev->ifindex;
			continue;
		case SKF_AD_MARK:
			A = skb->mark;
			continue;
		case SKF_AD_QUEUE:
			A = skb->queue_mapping;
			continue;
		case SKF_AD_HATYPE:
			if (!skb->dev)
				return 0;
			A = skb->dev->type;
			continue;
		case SKF_AD_NLATTR: {
			struct nlattr *nla;

			if (skb_is_nonlinear(skb))
				return 0;
			if (A > skb->len - sizeof(struct nlattr))
				return 0;

			nla = nla_find((struct nlattr *)&skb->data[A],
				       skb->len - A, X);
			if (nla)
				A = (void *)nla - (void *)skb->data;
			else
				A = 0;
			continue;
		}
		case SKF_AD_NLATTR_NEST: {
			struct nlattr *nla;

			if (skb_is_nonlinear(skb))
				return 0;
			if (A > skb->len - sizeof(struct nlattr))
				return 0;

			nla = (struct nlattr *)&skb->data[A];
			if (nla->nla_len > A - skb->len)
				return 0;

			nla = nla_find_nested(nla, X);
			if (nla)
				A = (void *)nla - (void *)skb->data;
			else
				A = 0;
			continue;
		}
		default:
			return 0;
		}
	}

	return 0;
}
EXPORT_SYMBOL(sk_run_filter);

/**
 *	sk_chk_filter - verify socket filter code
 *	@filter: filter to verify
 *	@flen: length of filter
 *
 * Check the user's filter code. If we let some ugly
 * filter code slip through kaboom! The filter must contain
 * no references or jumps that are out of range, no illegal
 * instructions, and must end with a RET instruction.
 *
 * All jumps are forward as they are not signed.
 *
 * Returns 0 if the rule set is legal or -EINVAL if not.
 */
int sk_chk_filter(struct sock_filter *filter, int flen)
{
	/*
	 * Valid instructions are initialized to non-0.
	 * Invalid instructions are initialized to 0.
	 */
	static const u8 codes[] = {
		[BPF_ALU|BPF_ADD|BPF_K]  = BPF_S_ALU_ADD_K + 1,
		[BPF_ALU|BPF_ADD|BPF_X]  = BPF_S_ALU_ADD_X + 1,
		[BPF_ALU|BPF_SUB|BPF_K]  = BPF_S_ALU_SUB_K + 1,
		[BPF_ALU|BPF_SUB|BPF_X]  = BPF_S_ALU_SUB_X + 1,
		[BPF_ALU|BPF_MUL|BPF_K]  = BPF_S_ALU_MUL_K + 1,
		[BPF_ALU|BPF_MUL|BPF_X]  = BPF_S_ALU_MUL_X + 1,
		[BPF_ALU|BPF_DIV|BPF_X]  = BPF_S_ALU_DIV_X + 1,
		[BPF_ALU|BPF_AND|BPF_K]  = BPF_S_ALU_AND_K + 1,
		[BPF_ALU|BPF_AND|BPF_X]  = BPF_S_ALU_AND_X + 1,
		[BPF_ALU|BPF_OR|BPF_K]   = BPF_S_ALU_OR_K + 1,
		[BPF_ALU|BPF_OR|BPF_X]   = BPF_S_ALU_OR_X + 1,
		[BPF_ALU|BPF_LSH|BPF_K]  = BPF_S_ALU_LSH_K + 1,
		[BPF_ALU|BPF_LSH|BPF_X]  = BPF_S_ALU_LSH_X + 1,
		[BPF_ALU|BPF_RSH|BPF_K]  = BPF_S_ALU_RSH_K + 1,
		[BPF_ALU|BPF_RSH|BPF_X]  = BPF_S_ALU_RSH_X + 1,
		[BPF_ALU|BPF_NEG]        = BPF_S_ALU_NEG + 1,
		[BPF_LD|BPF_W|BPF_ABS]   = BPF_S_LD_W_ABS + 1,
		[BPF_LD|BPF_H|BPF_ABS]   = BPF_S_LD_H_ABS + 1,
		[BPF_LD|BPF_B|BPF_ABS]   = BPF_S_LD_B_ABS + 1,
		[BPF_LD|BPF_W|BPF_LEN]   = BPF_S_LD_W_LEN + 1,
		[BPF_LD|BPF_W|BPF_IND]   = BPF_S_LD_W_IND + 1,
		[BPF_LD|BPF_H|BPF_IND]   = BPF_S_LD_H_IND + 1,
		[BPF_LD|BPF_B|BPF_IND]   = BPF_S_LD_B_IND + 1,
		[BPF_LD|BPF_IMM]         = BPF_S_LD_IMM + 1,
		[BPF_LDX|BPF_W|BPF_LEN]  = BPF_S_LDX_W_LEN + 1,
		[BPF_LDX|BPF_B|BPF_MSH]  = BPF_S_LDX_B_MSH + 1,
		[BPF_LDX|BPF_IMM]        = BPF_S_LDX_IMM + 1,
		[BPF_MISC|BPF_TAX]       = BPF_S_MISC_TAX + 1,
		[BPF_MISC|BPF_TXA]       = BPF_S_MISC_TXA + 1,
		[BPF_RET|BPF_K]          = BPF_S_RET_K + 1,
		[BPF_RET|BPF_A]          = BPF_S_RET_A + 1,
		[BPF_ALU|BPF_DIV|BPF_K]  = BPF_S_ALU_DIV_K + 1,
		[BPF_LD|BPF_MEM]         = BPF_S_LD_MEM + 1,
		[BPF_LDX|BPF_MEM]        = BPF_S_LDX_MEM + 1,
		[BPF_ST]                 = BPF_S_ST + 1,
		[BPF_STX]                = BPF_S_STX + 1,
		[BPF_JMP|BPF_JA]         = BPF_S_JMP_JA + 1,
		[BPF_JMP|BPF_JEQ|BPF_K]  = BPF_S_JMP_JEQ_K + 1,
		[BPF_JMP|BPF_JEQ|BPF_X]  = BPF_S_JMP_JEQ_X + 1,
		[BPF_JMP|BPF_JGE|BPF_K]  = BPF_S_JMP_JGE_K + 1,
		[BPF_JMP|BPF_JGE|BPF_X]  = BPF_S_JMP_JGE_X + 1,
		[BPF_JMP|BPF_JGT|BPF_K]  = BPF_S_JMP_JGT_K + 1,
		[BPF_JMP|BPF_JGT|BPF_X]  = BPF_S_JMP_JGT_X + 1,
		[BPF_JMP|BPF_JSET|BPF_K] = BPF_S_JMP_JSET_K + 1,
		[BPF_JMP|BPF_JSET|BPF_X] = BPF_S_JMP_JSET_X + 1,
	};
	int pc;

	if (flen == 0 || flen > BPF_MAXINSNS)
		return -EINVAL;

	/* check the filter code now */
	for (pc = 0; pc < flen; pc++) {
		struct sock_filter *ftest = &filter[pc];
		u16 code = ftest->code;

		if (code >= ARRAY_SIZE(codes))
			return -EINVAL;
		code = codes[code];
		/* Undo the '+ 1' in codes[] after validation. */
		if (!code--)
			return -EINVAL;
		/* Some instructions need special checks */
		switch (code) {
		case BPF_S_ALU_DIV_K:
			/* check for division by zero */
			if (ftest->k == 0)
				return -EINVAL;
			break;
		case BPF_S_LD_MEM:
		case BPF_S_LDX_MEM:
		case BPF_S_ST:
		case BPF_S_STX:
			/* check for invalid memory addresses */
			if (ftest->k >= BPF_MEMWORDS)
				return -EINVAL;
			break;
		case BPF_S_JMP_JA:
			/*
			 * Note, the large ftest->k might cause loops.
			 * Compare this with conditional jumps below,
			 * where offsets are limited. --ANK (981016)
			 */
			if (ftest->k >= (unsigned)(flen-pc-1))
				return -EINVAL;
			break;
		case BPF_S_JMP_JEQ_K:
		case BPF_S_JMP_JEQ_X:
		case BPF_S_JMP_JGE_K:
		case BPF_S_JMP_JGE_X:
		case BPF_S_JMP_JGT_K:
		case BPF_S_JMP_JGT_X:
		case BPF_S_JMP_JSET_X:
		case BPF_S_JMP_JSET_K:
			/* for conditionals both must be safe */
			if (pc + ftest->jt + 1 >= flen ||
			    pc + ftest->jf + 1 >= flen)
				return -EINVAL;
			break;
		}
		ftest->code = code;
	}

	/* last instruction must be a RET code */
	switch (filter[flen - 1].code) {
	case BPF_S_RET_K:
	case BPF_S_RET_A:
		return 0;
	}
	return -EINVAL;
}
EXPORT_SYMBOL(sk_chk_filter);

/**
 * 	sk_filter_rcu_release: Release a socket filter by rcu_head
 *	@rcu: rcu_head that contains the sk_filter to free
 */
static void sk_filter_rcu_release(struct rcu_head *rcu)
{
	struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);

	sk_filter_release(fp);
}

static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp)
{
	unsigned int size = sk_filter_len(fp);

	atomic_sub(size, &sk->sk_omem_alloc);
	call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
}

/**
 *	sk_attach_filter - attach a socket filter
 *	@fprog: the filter program
 *	@sk: the socket to use
 *
 * Attach the user's filter code. We first run some sanity checks on
 * it to make sure it does not explode on us later. If an error
 * occurs or there is insufficient memory for the filter a negative
 * errno code is returned. On success the return is zero.
 */
int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
{
	struct sk_filter *fp, *old_fp;
	unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
	int err;

	/* Make sure new filter is there and in the right amounts. */
	if (fprog->filter == NULL)
		return -EINVAL;

	fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
	if (!fp)
		return -ENOMEM;
	if (copy_from_user(fp->insns, fprog->filter, fsize)) {
		sock_kfree_s(sk, fp, fsize+sizeof(*fp));
		return -EFAULT;
	}

	atomic_set(&fp->refcnt, 1);
	fp->len = fprog->len;

	err = sk_chk_filter(fp->insns, fp->len);
	if (err) {
		sk_filter_uncharge(sk, fp);
		return err;
	}

	old_fp = rcu_dereference_protected(sk->sk_filter,
					   sock_owned_by_user(sk));
	rcu_assign_pointer(sk->sk_filter, fp);

	if (old_fp)
		sk_filter_delayed_uncharge(sk, old_fp);
	return 0;
}
EXPORT_SYMBOL_GPL(sk_attach_filter);

int sk_detach_filter(struct sock *sk)
{
	int ret = -ENOENT;
	struct sk_filter *filter;

	filter = rcu_dereference_protected(sk->sk_filter,
					   sock_owned_by_user(sk));
	if (filter) {
		rcu_assign_pointer(sk->sk_filter, NULL);
		sk_filter_delayed_uncharge(sk, filter);
		ret = 0;
	}
	return ret;
}
EXPORT_SYMBOL_GPL(sk_detach_filter);
Commit	Line	Data
1da177e4 LT	1	/*
	2	* Linux Socket Filter - Kernel level socket filtering
	3	*
	4	* Author:
	5	* Jay Schulist <jschlst@samba.org>
	6	*
	7	* Based on the design of:
	8	* - The Berkeley Packet Filter
	9	*
	10	* This program is free software; you can redistribute it and/or
	11	* modify it under the terms of the GNU General Public License
	12	* as published by the Free Software Foundation; either version
	13	* 2 of the License, or (at your option) any later version.
	14	*
	15	* Andi Kleen - Fix a few bad bugs and races.
93699863	16	* Kris Katterjohn - Added many additional checks in sk_chk_filter()
1da177e4 LT	17	*/
	18
	19	#include <linux/module.h>
	20	#include <linux/types.h>
1da177e4 LT	21	#include <linux/mm.h>
	22	#include <linux/fcntl.h>
	23	#include <linux/socket.h>
	24	#include <linux/in.h>
	25	#include <linux/inet.h>
	26	#include <linux/netdevice.h>
	27	#include <linux/if_packet.h>
5a0e3ad6	28	#include <linux/gfp.h>
1da177e4 LT	29	#include <net/ip.h>
1da177e4 LT	30	#include <net/protocol.h>
4738c1db	31	#include <net/netlink.h>
1da177e4 LT	32	#include <linux/skbuff.h>
	33	#include <net/sock.h>
	34	#include <linux/errno.h>
	35	#include <linux/timer.h>
	36	#include <asm/system.h>
	37	#include <asm/uaccess.h>
40daafc8	38	#include <asm/unaligned.h>
1da177e4 LT	39	#include <linux/filter.h>
1da177e4 LT	40
4c3710af CG	41	enum {
	42	BPF_S_RET_K = 0,
	43	BPF_S_RET_A,
	44	BPF_S_ALU_ADD_K,
	45	BPF_S_ALU_ADD_X,
	46	BPF_S_ALU_SUB_K,
	47	BPF_S_ALU_SUB_X,
	48	BPF_S_ALU_MUL_K,
	49	BPF_S_ALU_MUL_X,
	50	BPF_S_ALU_DIV_X,
	51	BPF_S_ALU_AND_K,
	52	BPF_S_ALU_AND_X,
	53	BPF_S_ALU_OR_K,
	54	BPF_S_ALU_OR_X,
	55	BPF_S_ALU_LSH_K,
	56	BPF_S_ALU_LSH_X,
	57	BPF_S_ALU_RSH_K,
	58	BPF_S_ALU_RSH_X,
	59	BPF_S_ALU_NEG,
	60	BPF_S_LD_W_ABS,
	61	BPF_S_LD_H_ABS,
	62	BPF_S_LD_B_ABS,
	63	BPF_S_LD_W_LEN,
	64	BPF_S_LD_W_IND,
	65	BPF_S_LD_H_IND,
	66	BPF_S_LD_B_IND,
	67	BPF_S_LD_IMM,
	68	BPF_S_LDX_W_LEN,
	69	BPF_S_LDX_B_MSH,
	70	BPF_S_LDX_IMM,
	71	BPF_S_MISC_TAX,
	72	BPF_S_MISC_TXA,
	73	BPF_S_ALU_DIV_K,
	74	BPF_S_LD_MEM,
	75	BPF_S_LDX_MEM,
	76	BPF_S_ST,
	77	BPF_S_STX,
	78	BPF_S_JMP_JA,
	79	BPF_S_JMP_JEQ_K,
	80	BPF_S_JMP_JEQ_X,
	81	BPF_S_JMP_JGE_K,
	82	BPF_S_JMP_JGE_X,
	83	BPF_S_JMP_JGT_K,
	84	BPF_S_JMP_JGT_X,
	85	BPF_S_JMP_JSET_K,
	86	BPF_S_JMP_JSET_X,
	87	};
	88
1da177e4	89	/* No hurry in this branch */
0b05b2a4	90	static void __load_pointer(struct sk_buff skb, int k)
1da177e4 LT	91	{
	92	u8 *ptr = NULL;
	93
	94	if (k >= SKF_NET_OFF)
d56f90a7	95	ptr = skb_network_header(skb) + k - SKF_NET_OFF;
1da177e4	96	else if (k >= SKF_LL_OFF)
98e399f8	97	ptr = skb_mac_header(skb) + k - SKF_LL_OFF;
1da177e4	98
27a884dc	99	if (ptr >= skb->head && ptr < skb_tail_pointer(skb))
1da177e4 LT	100	return ptr;
	101	return NULL;
	102	}
	103
0b05b2a4	104	static inline void load_pointer(struct sk_buff skb, int k,
4ec93edb	105	unsigned int size, void *buffer)
0b05b2a4 PM	106	{
	107	if (k >= 0)
	108	return skb_header_pointer(skb, k, size, buffer);
	109	else {
	110	if (k >= SKF_AD_OFF)
	111	return NULL;
	112	return __load_pointer(skb, k);
	113	}
	114	}
	115
43db6d65 SH	116	/**
	117	* sk_filter - run a packet through a socket filter
	118	* @sk: sock associated with &sk_buff
	119	* @skb: buffer to filter
43db6d65 SH	120	*
	121	* Run the filter code and then cut skb->data to correct size returned by
	122	* sk_run_filter. If pkt_len is 0 we toss packet. If skb->len is smaller
	123	* than pkt_len we keep whole skb->data. This is the socket level
	124	* wrapper to sk_run_filter. It returns 0 if the packet should
	125	* be accepted or -EPERM if the packet should be tossed.
	126	*
	127	*/
	128	int sk_filter(struct sock sk, struct sk_buff skb)
	129	{
	130	int err;
	131	struct sk_filter *filter;
	132
	133	err = security_sock_rcv_skb(sk, skb);
	134	if (err)
	135	return err;
	136
	137	rcu_read_lock_bh();
a898def2	138	filter = rcu_dereference_bh(sk->sk_filter);
43db6d65	139	if (filter) {
0d7da9dd ED	140	unsigned int pkt_len = sk_run_filter(skb, filter->insns, filter->len);
0d7da9dd ED	141
43db6d65 SH	142	err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM;
	143	}
	144	rcu_read_unlock_bh();
	145
	146	return err;
	147	}
	148	EXPORT_SYMBOL(sk_filter);
	149
1da177e4	150	/**
2966b66c	151	* sk_run_filter - run a filter on a socket
1da177e4 LT	152	* @skb: buffer to run the filter on
	153	* @filter: filter to apply
	154	* @flen: length of filter
	155	*
	156	* Decode and apply filter instructions to the skb->data.
	157	* Return length to keep, 0 for none. skb is the data we are
	158	* filtering, filter is the array of filter instructions, and
	159	* len is the number of filter blocks in the array.
	160	*/
4bad4dc9	161	unsigned int sk_run_filter(struct sk_buff skb, struct sock_filter filter, int flen)
1da177e4	162	{
0b05b2a4	163	void *ptr;
2966b66c KK	164	u32 A = 0; /* Accumulator */
2966b66c KK	165	u32 X = 0; /* Index Register */
1da177e4	166	u32 mem[BPF_MEMWORDS]; /* Scratch Memory Store */
57fe93b3	167	unsigned long memvalid = 0;
0b05b2a4	168	u32 tmp;
1da177e4 LT	169	int k;
	170	int pc;
	171
57fe93b3	172	BUILD_BUG_ON(BPF_MEMWORDS > BITS_PER_LONG);
1da177e4 LT	173	/*
	174	* Process array of filter instructions.
	175	*/
	176	for (pc = 0; pc < flen; pc++) {
57fe93b3 DM	177	const struct sock_filter *fentry = &filter[pc];
57fe93b3 DM	178	u32 f_k = fentry->k;
4ec93edb	179
1da177e4	180	switch (fentry->code) {
01f2f3f6	181	case BPF_S_ALU_ADD_X:
1da177e4 LT	182	A += X;
1da177e4 LT	183	continue;
01f2f3f6	184	case BPF_S_ALU_ADD_K:
57fe93b3	185	A += f_k;
1da177e4	186	continue;
01f2f3f6	187	case BPF_S_ALU_SUB_X:
1da177e4 LT	188	A -= X;
1da177e4 LT	189	continue;
01f2f3f6	190	case BPF_S_ALU_SUB_K:
57fe93b3	191	A -= f_k;
1da177e4	192	continue;
01f2f3f6	193	case BPF_S_ALU_MUL_X:
1da177e4 LT	194	A *= X;
1da177e4 LT	195	continue;
01f2f3f6	196	case BPF_S_ALU_MUL_K:
57fe93b3	197	A *= f_k;
1da177e4	198	continue;
01f2f3f6	199	case BPF_S_ALU_DIV_X:
1da177e4 LT	200	if (X == 0)
	201	return 0;
	202	A /= X;
	203	continue;
01f2f3f6	204	case BPF_S_ALU_DIV_K:
57fe93b3	205	A /= f_k;
1da177e4	206	continue;
01f2f3f6	207	case BPF_S_ALU_AND_X:
1da177e4 LT	208	A &= X;
1da177e4 LT	209	continue;
01f2f3f6	210	case BPF_S_ALU_AND_K:
57fe93b3	211	A &= f_k;
1da177e4	212	continue;
01f2f3f6	213	case BPF_S_ALU_OR_X:
1da177e4 LT	214	A \|= X;
1da177e4 LT	215	continue;
01f2f3f6	216	case BPF_S_ALU_OR_K:
57fe93b3	217	A \|= f_k;
1da177e4	218	continue;
01f2f3f6	219	case BPF_S_ALU_LSH_X:
1da177e4 LT	220	A <<= X;
1da177e4 LT	221	continue;
01f2f3f6	222	case BPF_S_ALU_LSH_K:
57fe93b3	223	A <<= f_k;
1da177e4	224	continue;
01f2f3f6	225	case BPF_S_ALU_RSH_X:
1da177e4 LT	226	A >>= X;
1da177e4 LT	227	continue;
01f2f3f6	228	case BPF_S_ALU_RSH_K:
57fe93b3	229	A >>= f_k;
1da177e4	230	continue;
01f2f3f6	231	case BPF_S_ALU_NEG:
1da177e4 LT	232	A = -A;
1da177e4 LT	233	continue;
01f2f3f6	234	case BPF_S_JMP_JA:
57fe93b3	235	pc += f_k;
1da177e4	236	continue;
01f2f3f6	237	case BPF_S_JMP_JGT_K:
57fe93b3	238	pc += (A > f_k) ? fentry->jt : fentry->jf;
1da177e4	239	continue;
01f2f3f6	240	case BPF_S_JMP_JGE_K:
57fe93b3	241	pc += (A >= f_k) ? fentry->jt : fentry->jf;
1da177e4	242	continue;
01f2f3f6	243	case BPF_S_JMP_JEQ_K:
57fe93b3	244	pc += (A == f_k) ? fentry->jt : fentry->jf;
1da177e4	245	continue;
01f2f3f6	246	case BPF_S_JMP_JSET_K:
57fe93b3	247	pc += (A & f_k) ? fentry->jt : fentry->jf;
1da177e4	248	continue;
01f2f3f6	249	case BPF_S_JMP_JGT_X:
1da177e4 LT	250	pc += (A > X) ? fentry->jt : fentry->jf;
1da177e4 LT	251	continue;
01f2f3f6	252	case BPF_S_JMP_JGE_X:
1da177e4 LT	253	pc += (A >= X) ? fentry->jt : fentry->jf;
1da177e4 LT	254	continue;
01f2f3f6	255	case BPF_S_JMP_JEQ_X:
1da177e4 LT	256	pc += (A == X) ? fentry->jt : fentry->jf;
1da177e4 LT	257	continue;
01f2f3f6	258	case BPF_S_JMP_JSET_X:
1da177e4 LT	259	pc += (A & X) ? fentry->jt : fentry->jf;
1da177e4 LT	260	continue;
01f2f3f6	261	case BPF_S_LD_W_ABS:
57fe93b3	262	k = f_k;
e35bedf3	263	load_w:
0b05b2a4 PM	264	ptr = load_pointer(skb, k, 4, &tmp);
0b05b2a4 PM	265	if (ptr != NULL) {
d3e2ce3b	266	A = get_unaligned_be32(ptr);
0b05b2a4	267	continue;
1da177e4	268	}
1198ad00	269	break;
01f2f3f6	270	case BPF_S_LD_H_ABS:
57fe93b3	271	k = f_k;
e35bedf3	272	load_h:
0b05b2a4 PM	273	ptr = load_pointer(skb, k, 2, &tmp);
0b05b2a4 PM	274	if (ptr != NULL) {
d3e2ce3b	275	A = get_unaligned_be16(ptr);
0b05b2a4	276	continue;
1da177e4	277	}
1198ad00	278	break;
01f2f3f6	279	case BPF_S_LD_B_ABS:
57fe93b3	280	k = f_k;
1da177e4	281	load_b:
0b05b2a4 PM	282	ptr = load_pointer(skb, k, 1, &tmp);
	283	if (ptr != NULL) {
	284	A = (u8 )ptr;
	285	continue;
1da177e4	286	}
1198ad00	287	break;
01f2f3f6	288	case BPF_S_LD_W_LEN:
3154e540	289	A = skb->len;
1da177e4	290	continue;
01f2f3f6	291	case BPF_S_LDX_W_LEN:
3154e540	292	X = skb->len;
1da177e4	293	continue;
01f2f3f6	294	case BPF_S_LD_W_IND:
57fe93b3	295	k = X + f_k;
1da177e4	296	goto load_w;
01f2f3f6	297	case BPF_S_LD_H_IND:
57fe93b3	298	k = X + f_k;
1da177e4	299	goto load_h;
01f2f3f6	300	case BPF_S_LD_B_IND:
57fe93b3	301	k = X + f_k;
1da177e4	302	goto load_b;
01f2f3f6	303	case BPF_S_LDX_B_MSH:
57fe93b3	304	ptr = load_pointer(skb, f_k, 1, &tmp);
0b05b2a4 PM	305	if (ptr != NULL) {
	306	X = ((u8 )ptr & 0xf) << 2;
	307	continue;
	308	}
	309	return 0;
01f2f3f6	310	case BPF_S_LD_IMM:
57fe93b3	311	A = f_k;
1da177e4	312	continue;
01f2f3f6	313	case BPF_S_LDX_IMM:
57fe93b3	314	X = f_k;
1da177e4	315	continue;
01f2f3f6	316	case BPF_S_LD_MEM:
57fe93b3 DM	317	A = (memvalid & (1UL << f_k)) ?
57fe93b3 DM	318	mem[f_k] : 0;
1da177e4	319	continue;
01f2f3f6	320	case BPF_S_LDX_MEM:
57fe93b3 DM	321	X = (memvalid & (1UL << f_k)) ?
57fe93b3 DM	322	mem[f_k] : 0;
1da177e4	323	continue;
01f2f3f6	324	case BPF_S_MISC_TAX:
1da177e4 LT	325	X = A;
1da177e4 LT	326	continue;
01f2f3f6	327	case BPF_S_MISC_TXA:
1da177e4 LT	328	A = X;
1da177e4 LT	329	continue;
01f2f3f6	330	case BPF_S_RET_K:
57fe93b3	331	return f_k;
01f2f3f6	332	case BPF_S_RET_A:
4bad4dc9	333	return A;
01f2f3f6	334	case BPF_S_ST:
57fe93b3 DM	335	memvalid \|= 1UL << f_k;
57fe93b3 DM	336	mem[f_k] = A;
1da177e4	337	continue;
01f2f3f6	338	case BPF_S_STX:
57fe93b3 DM	339	memvalid \|= 1UL << f_k;
57fe93b3 DM	340	mem[f_k] = X;
1da177e4 LT	341	continue;
1da177e4 LT	342	default:
93699863	343	WARN_ON(1);
1da177e4 LT	344	return 0;
	345	}
	346
	347	/*
	348	* Handle ancillary data, which are impossible
	349	* (or very difficult) to get parsing packet contents.
	350	*/
	351	switch (k-SKF_AD_OFF) {
	352	case SKF_AD_PROTOCOL:
252e3346	353	A = ntohs(skb->protocol);
1da177e4 LT	354	continue;
	355	case SKF_AD_PKTTYPE:
	356	A = skb->pkt_type;
	357	continue;
	358	case SKF_AD_IFINDEX:
40eaf962 PLE	359	if (!skb->dev)
40eaf962 PLE	360	return 0;
1da177e4 LT	361	A = skb->dev->ifindex;
1da177e4 LT	362	continue;
7e75f93e	363	case SKF_AD_MARK:
	364	A = skb->mark;
	365	continue;
d19742fb ED	366	case SKF_AD_QUEUE:
	367	A = skb->queue_mapping;
	368	continue;
40eaf962 PLE	369	case SKF_AD_HATYPE:
	370	if (!skb->dev)
	371	return 0;
	372	A = skb->dev->type;
	373	continue;
4738c1db PM	374	case SKF_AD_NLATTR: {
	375	struct nlattr *nla;
	376
	377	if (skb_is_nonlinear(skb))
	378	return 0;
	379	if (A > skb->len - sizeof(struct nlattr))
	380	return 0;
	381
	382	nla = nla_find((struct nlattr *)&skb->data[A],
	383	skb->len - A, X);
	384	if (nla)
	385	A = (void )nla - (void )skb->data;
	386	else
	387	A = 0;
	388	continue;
	389	}
d214c753 PNA	390	case SKF_AD_NLATTR_NEST: {
	391	struct nlattr *nla;
	392
	393	if (skb_is_nonlinear(skb))
	394	return 0;
	395	if (A > skb->len - sizeof(struct nlattr))
	396	return 0;
	397
	398	nla = (struct nlattr *)&skb->data[A];
	399	if (nla->nla_len > A - skb->len)
	400	return 0;
	401
	402	nla = nla_find_nested(nla, X);
	403	if (nla)
	404	A = (void )nla - (void )skb->data;
	405	else
	406	A = 0;
	407	continue;
	408	}
1da177e4 LT	409	default:
	410	return 0;
	411	}
	412	}
	413
	414	return 0;
	415	}
b715631f	416	EXPORT_SYMBOL(sk_run_filter);
1da177e4 LT	417
	418	/**
	419	* sk_chk_filter - verify socket filter code
	420	* @filter: filter to verify
	421	* @flen: length of filter
	422	*
	423	* Check the user's filter code. If we let some ugly
	424	* filter code slip through kaboom! The filter must contain
93699863 KK	425	* no references or jumps that are out of range, no illegal
93699863 KK	426	* instructions, and must end with a RET instruction.
1da177e4	427	*
7b11f69f KK	428	* All jumps are forward as they are not signed.
	429	*
	430	* Returns 0 if the rule set is legal or -EINVAL if not.
1da177e4 LT	431	*/
	432	int sk_chk_filter(struct sock_filter *filter, int flen)
	433	{
cba328fc TH	434	/*
	435	* Valid instructions are initialized to non-0.
	436	* Invalid instructions are initialized to 0.
	437	*/
	438	static const u8 codes[] = {
	439	[BPF_ALU\|BPF_ADD\|BPF_K] = BPF_S_ALU_ADD_K + 1,
	440	[BPF_ALU\|BPF_ADD\|BPF_X] = BPF_S_ALU_ADD_X + 1,
	441	[BPF_ALU\|BPF_SUB\|BPF_K] = BPF_S_ALU_SUB_K + 1,
	442	[BPF_ALU\|BPF_SUB\|BPF_X] = BPF_S_ALU_SUB_X + 1,
	443	[BPF_ALU\|BPF_MUL\|BPF_K] = BPF_S_ALU_MUL_K + 1,
	444	[BPF_ALU\|BPF_MUL\|BPF_X] = BPF_S_ALU_MUL_X + 1,
	445	[BPF_ALU\|BPF_DIV\|BPF_X] = BPF_S_ALU_DIV_X + 1,
	446	[BPF_ALU\|BPF_AND\|BPF_K] = BPF_S_ALU_AND_K + 1,
	447	[BPF_ALU\|BPF_AND\|BPF_X] = BPF_S_ALU_AND_X + 1,
	448	[BPF_ALU\|BPF_OR\|BPF_K] = BPF_S_ALU_OR_K + 1,
	449	[BPF_ALU\|BPF_OR\|BPF_X] = BPF_S_ALU_OR_X + 1,
	450	[BPF_ALU\|BPF_LSH\|BPF_K] = BPF_S_ALU_LSH_K + 1,
	451	[BPF_ALU\|BPF_LSH\|BPF_X] = BPF_S_ALU_LSH_X + 1,
	452	[BPF_ALU\|BPF_RSH\|BPF_K] = BPF_S_ALU_RSH_K + 1,
	453	[BPF_ALU\|BPF_RSH\|BPF_X] = BPF_S_ALU_RSH_X + 1,
	454	[BPF_ALU\|BPF_NEG] = BPF_S_ALU_NEG + 1,
	455	[BPF_LD\|BPF_W\|BPF_ABS] = BPF_S_LD_W_ABS + 1,
	456	[BPF_LD\|BPF_H\|BPF_ABS] = BPF_S_LD_H_ABS + 1,
	457	[BPF_LD\|BPF_B\|BPF_ABS] = BPF_S_LD_B_ABS + 1,
	458	[BPF_LD\|BPF_W\|BPF_LEN] = BPF_S_LD_W_LEN + 1,
	459	[BPF_LD\|BPF_W\|BPF_IND] = BPF_S_LD_W_IND + 1,
	460	[BPF_LD\|BPF_H\|BPF_IND] = BPF_S_LD_H_IND + 1,
	461	[BPF_LD\|BPF_B\|BPF_IND] = BPF_S_LD_B_IND + 1,
	462	[BPF_LD\|BPF_IMM] = BPF_S_LD_IMM + 1,
	463	[BPF_LDX\|BPF_W\|BPF_LEN] = BPF_S_LDX_W_LEN + 1,
	464	[BPF_LDX\|BPF_B\|BPF_MSH] = BPF_S_LDX_B_MSH + 1,
	465	[BPF_LDX\|BPF_IMM] = BPF_S_LDX_IMM + 1,
	466	[BPF_MISC\|BPF_TAX] = BPF_S_MISC_TAX + 1,
	467	[BPF_MISC\|BPF_TXA] = BPF_S_MISC_TXA + 1,
	468	[BPF_RET\|BPF_K] = BPF_S_RET_K + 1,
	469	[BPF_RET\|BPF_A] = BPF_S_RET_A + 1,
	470	[BPF_ALU\|BPF_DIV\|BPF_K] = BPF_S_ALU_DIV_K + 1,
	471	[BPF_LD\|BPF_MEM] = BPF_S_LD_MEM + 1,
	472	[BPF_LDX\|BPF_MEM] = BPF_S_LDX_MEM + 1,
	473	[BPF_ST] = BPF_S_ST + 1,
	474	[BPF_STX] = BPF_S_STX + 1,
	475	[BPF_JMP\|BPF_JA] = BPF_S_JMP_JA + 1,
	476	[BPF_JMP\|BPF_JEQ\|BPF_K] = BPF_S_JMP_JEQ_K + 1,
	477	[BPF_JMP\|BPF_JEQ\|BPF_X] = BPF_S_JMP_JEQ_X + 1,
	478	[BPF_JMP\|BPF_JGE\|BPF_K] = BPF_S_JMP_JGE_K + 1,
	479	[BPF_JMP\|BPF_JGE\|BPF_X] = BPF_S_JMP_JGE_X + 1,
	480	[BPF_JMP\|BPF_JGT\|BPF_K] = BPF_S_JMP_JGT_K + 1,
	481	[BPF_JMP\|BPF_JGT\|BPF_X] = BPF_S_JMP_JGT_X + 1,
	482	[BPF_JMP\|BPF_JSET\|BPF_K] = BPF_S_JMP_JSET_K + 1,
	483	[BPF_JMP\|BPF_JSET\|BPF_X] = BPF_S_JMP_JSET_X + 1,
	484	};
1da177e4 LT	485	int pc;
1da177e4 LT	486
1b93ae64	487	if (flen == 0 \|\| flen > BPF_MAXINSNS)
1da177e4 LT	488	return -EINVAL;
	489
	490	/* check the filter code now */
	491	for (pc = 0; pc < flen; pc++) {
cba328fc TH	492	struct sock_filter *ftest = &filter[pc];
cba328fc TH	493	u16 code = ftest->code;
93699863	494
cba328fc TH	495	if (code >= ARRAY_SIZE(codes))
	496	return -EINVAL;
	497	code = codes[code];
	498	/* Undo the '+ 1' in codes[] after validation. */
	499	if (!code--)
	500	return -EINVAL;
93699863	501	/* Some instructions need special checks */
cba328fc TH	502	switch (code) {
cba328fc TH	503	case BPF_S_ALU_DIV_K:
93699863 KK	504	/* check for division by zero */
93699863 KK	505	if (ftest->k == 0)
1da177e4	506	return -EINVAL;
93699863	507	break;
cba328fc TH	508	case BPF_S_LD_MEM:
	509	case BPF_S_LDX_MEM:
	510	case BPF_S_ST:
	511	case BPF_S_STX:
	512	/* check for invalid memory addresses */
93699863 KK	513	if (ftest->k >= BPF_MEMWORDS)
	514	return -EINVAL;
	515	break;
cba328fc	516	case BPF_S_JMP_JA:
93699863 KK	517	/*
	518	* Note, the large ftest->k might cause loops.
	519	* Compare this with conditional jumps below,
	520	* where offsets are limited. --ANK (981016)
	521	*/
	522	if (ftest->k >= (unsigned)(flen-pc-1))
	523	return -EINVAL;
01f2f3f6	524	break;
01f2f3f6 HPP	525	case BPF_S_JMP_JEQ_K:
	526	case BPF_S_JMP_JEQ_X:
	527	case BPF_S_JMP_JGE_K:
	528	case BPF_S_JMP_JGE_X:
	529	case BPF_S_JMP_JGT_K:
	530	case BPF_S_JMP_JGT_X:
	531	case BPF_S_JMP_JSET_X:
	532	case BPF_S_JMP_JSET_K:
cba328fc	533	/* for conditionals both must be safe */
e35bedf3	534	if (pc + ftest->jt + 1 >= flen \|\|
93699863 KK	535	pc + ftest->jf + 1 >= flen)
93699863 KK	536	return -EINVAL;
cba328fc	537	break;
01f2f3f6	538	}
cba328fc	539	ftest->code = code;
01f2f3f6	540	}
93699863	541
01f2f3f6 HPP	542	/* last instruction must be a RET code */
	543	switch (filter[flen - 1].code) {
	544	case BPF_S_RET_K:
	545	case BPF_S_RET_A:
	546	return 0;
cba328fc TH	547	}
cba328fc TH	548	return -EINVAL;
1da177e4	549	}
b715631f	550	EXPORT_SYMBOL(sk_chk_filter);
1da177e4	551
47e958ea PE	552	/**
	553	* sk_filter_rcu_release: Release a socket filter by rcu_head
	554	* @rcu: rcu_head that contains the sk_filter to free
	555	*/
	556	static void sk_filter_rcu_release(struct rcu_head *rcu)
	557	{
	558	struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
	559
	560	sk_filter_release(fp);
	561	}
	562
	563	static void sk_filter_delayed_uncharge(struct sock sk, struct sk_filter fp)
	564	{
	565	unsigned int size = sk_filter_len(fp);
	566
	567	atomic_sub(size, &sk->sk_omem_alloc);
	568	call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
	569	}
	570
1da177e4 LT	571	/**
	572	* sk_attach_filter - attach a socket filter
	573	* @fprog: the filter program
	574	* @sk: the socket to use
	575	*
	576	* Attach the user's filter code. We first run some sanity checks on
	577	* it to make sure it does not explode on us later. If an error
	578	* occurs or there is insufficient memory for the filter a negative
	579	* errno code is returned. On success the return is zero.
	580	*/
	581	int sk_attach_filter(struct sock_fprog fprog, struct sock sk)
	582	{
d3904b73	583	struct sk_filter fp, old_fp;
1da177e4 LT	584	unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
	585	int err;
	586
	587	/* Make sure new filter is there and in the right amounts. */
e35bedf3 KK	588	if (fprog->filter == NULL)
e35bedf3 KK	589	return -EINVAL;
1da177e4 LT	590
	591	fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
	592	if (!fp)
	593	return -ENOMEM;
	594	if (copy_from_user(fp->insns, fprog->filter, fsize)) {
4ec93edb	595	sock_kfree_s(sk, fp, fsize+sizeof(*fp));
1da177e4 LT	596	return -EFAULT;
	597	}
	598
	599	atomic_set(&fp->refcnt, 1);
	600	fp->len = fprog->len;
	601
	602	err = sk_chk_filter(fp->insns, fp->len);
d3904b73 PE	603	if (err) {
	604	sk_filter_uncharge(sk, fp);
	605	return err;
1da177e4 LT	606	}
1da177e4 LT	607
f91ff5b9 ED	608	old_fp = rcu_dereference_protected(sk->sk_filter,
f91ff5b9 ED	609	sock_owned_by_user(sk));
d3904b73	610	rcu_assign_pointer(sk->sk_filter, fp);
d3904b73	611
9b013e05 OJ	612	if (old_fp)
9b013e05 OJ	613	sk_filter_delayed_uncharge(sk, old_fp);
d3904b73	614	return 0;
1da177e4	615	}
5ff3f073	616	EXPORT_SYMBOL_GPL(sk_attach_filter);
1da177e4	617
55b33325 PE	618	int sk_detach_filter(struct sock *sk)
	619	{
	620	int ret = -ENOENT;
	621	struct sk_filter *filter;
	622
f91ff5b9 ED	623	filter = rcu_dereference_protected(sk->sk_filter,
f91ff5b9 ED	624	sock_owned_by_user(sk));
55b33325 PE	625	if (filter) {
55b33325 PE	626	rcu_assign_pointer(sk->sk_filter, NULL);
47e958ea	627	sk_filter_delayed_uncharge(sk, filter);
55b33325 PE	628	ret = 0;
55b33325 PE	629	}
55b33325 PE	630	return ret;
55b33325 PE	631	}
5ff3f073	632	EXPORT_SYMBOL_GPL(sk_detach_filter);