[net-next-2.6.git] / net / core / filter.c

/*
 * Linux Socket Filter - Kernel level socket filtering
 *
 * Author:
 *     Jay Schulist <jschlst@samba.org>
 *
 * Based on the design of:
 *     - The Berkeley Packet Filter
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 *
 * Andi Kleen - Fix a few bad bugs and races.
 * Kris Katterjohn - Added many additional checks in sk_chk_filter()
 */

#include <linux/module.h>
#include <linux/types.h>
#include <linux/mm.h>
#include <linux/fcntl.h>
#include <linux/socket.h>
#include <linux/in.h>
#include <linux/inet.h>
#include <linux/netdevice.h>
#include <linux/if_packet.h>
#include <linux/gfp.h>
#include <net/ip.h>
#include <net/protocol.h>
#include <net/netlink.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <linux/errno.h>
#include <linux/timer.h>
#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>
#include <linux/filter.h>

/* No hurry in this branch */
static void *__load_pointer(struct sk_buff *skb, int k)
{
	u8 *ptr = NULL;

	if (k >= SKF_NET_OFF)
		ptr = skb_network_header(skb) + k - SKF_NET_OFF;
	else if (k >= SKF_LL_OFF)
		ptr = skb_mac_header(skb) + k - SKF_LL_OFF;

	if (ptr >= skb->head && ptr < skb_tail_pointer(skb))
		return ptr;
	return NULL;
}

static inline void *load_pointer(struct sk_buff *skb, int k,
				 unsigned int size, void *buffer)
{
	if (k >= 0)
		return skb_header_pointer(skb, k, size, buffer);
	else {
		if (k >= SKF_AD_OFF)
			return NULL;
		return __load_pointer(skb, k);
	}
}

/**
 *	sk_filter - run a packet through a socket filter
 *	@sk: sock associated with &sk_buff
 *	@skb: buffer to filter
 *
 * Run the filter code and then cut skb->data to correct size returned by
 * sk_run_filter. If pkt_len is 0 we toss packet. If skb->len is smaller
 * than pkt_len we keep whole skb->data. This is the socket level
 * wrapper to sk_run_filter. It returns 0 if the packet should
 * be accepted or -EPERM if the packet should be tossed.
 *
 */
int sk_filter(struct sock *sk, struct sk_buff *skb)
{
	int err;
	struct sk_filter *filter;

	err = security_sock_rcv_skb(sk, skb);
	if (err)
		return err;

	rcu_read_lock_bh();
	filter = rcu_dereference_bh(sk->sk_filter);
	if (filter) {
		unsigned int pkt_len = sk_run_filter(skb, filter->insns,
				filter->len);
		err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM;
	}
	rcu_read_unlock_bh();

	return err;
}
EXPORT_SYMBOL(sk_filter);

/**
 *	sk_run_filter - run a filter on a socket
 *	@skb: buffer to run the filter on
 *	@filter: filter to apply
 *	@flen: length of filter
 *
 * Decode and apply filter instructions to the skb->data.
 * Return length to keep, 0 for none. skb is the data we are
 * filtering, filter is the array of filter instructions, and
 * len is the number of filter blocks in the array.
 */
unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
{
	struct sock_filter *fentry;	/* We walk down these */
	void *ptr;
	u32 A = 0;			/* Accumulator */
	u32 X = 0;			/* Index Register */
	u32 mem[BPF_MEMWORDS];		/* Scratch Memory Store */
	u32 tmp;
	int k;
	int pc;

	/*
	 * Process array of filter instructions.
	 */
	for (pc = 0; pc < flen; pc++) {
		fentry = &filter[pc];

		switch (fentry->code) {
		case BPF_S_ALU_ADD_X:
			A += X;
			continue;
		case BPF_S_ALU_ADD_K:
			A += fentry->k;
			continue;
		case BPF_S_ALU_SUB_X:
			A -= X;
			continue;
		case BPF_S_ALU_SUB_K:
			A -= fentry->k;
			continue;
		case BPF_S_ALU_MUL_X:
			A *= X;
			continue;
		case BPF_S_ALU_MUL_K:
			A *= fentry->k;
			continue;
		case BPF_S_ALU_DIV_X:
			if (X == 0)
				return 0;
			A /= X;
			continue;
		case BPF_S_ALU_DIV_K:
			A /= fentry->k;
			continue;
		case BPF_S_ALU_AND_X:
			A &= X;
			continue;
		case BPF_S_ALU_AND_K:
			A &= fentry->k;
			continue;
		case BPF_S_ALU_OR_X:
			A |= X;
			continue;
		case BPF_S_ALU_OR_K:
			A |= fentry->k;
			continue;
		case BPF_S_ALU_LSH_X:
			A <<= X;
			continue;
		case BPF_S_ALU_LSH_K:
			A <<= fentry->k;
			continue;
		case BPF_S_ALU_RSH_X:
			A >>= X;
			continue;
		case BPF_S_ALU_RSH_K:
			A >>= fentry->k;
			continue;
		case BPF_S_ALU_NEG:
			A = -A;
			continue;
		case BPF_S_JMP_JA:
			pc += fentry->k;
			continue;
		case BPF_S_JMP_JGT_K:
			pc += (A > fentry->k) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JGE_K:
			pc += (A >= fentry->k) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JEQ_K:
			pc += (A == fentry->k) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JSET_K:
			pc += (A & fentry->k) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JGT_X:
			pc += (A > X) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JGE_X:
			pc += (A >= X) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JEQ_X:
			pc += (A == X) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_JMP_JSET_X:
			pc += (A & X) ? fentry->jt : fentry->jf;
			continue;
		case BPF_S_LD_W_ABS:
			k = fentry->k;
load_w:
			ptr = load_pointer(skb, k, 4, &tmp);
			if (ptr != NULL) {
				A = get_unaligned_be32(ptr);
				continue;
			}
			break;
		case BPF_S_LD_H_ABS:
			k = fentry->k;
load_h:
			ptr = load_pointer(skb, k, 2, &tmp);
			if (ptr != NULL) {
				A = get_unaligned_be16(ptr);
				continue;
			}
			break;
		case BPF_S_LD_B_ABS:
			k = fentry->k;
load_b:
			ptr = load_pointer(skb, k, 1, &tmp);
			if (ptr != NULL) {
				A = *(u8 *)ptr;
				continue;
			}
			break;
		case BPF_S_LD_W_LEN:
			A = skb->len;
			continue;
		case BPF_S_LDX_W_LEN:
			X = skb->len;
			continue;
		case BPF_S_LD_W_IND:
			k = X + fentry->k;
			goto load_w;
		case BPF_S_LD_H_IND:
			k = X + fentry->k;
			goto load_h;
		case BPF_S_LD_B_IND:
			k = X + fentry->k;
			goto load_b;
		case BPF_S_LDX_B_MSH:
			ptr = load_pointer(skb, fentry->k, 1, &tmp);
			if (ptr != NULL) {
				X = (*(u8 *)ptr & 0xf) << 2;
				continue;
			}
			return 0;
		case BPF_S_LD_IMM:
			A = fentry->k;
			continue;
		case BPF_S_LDX_IMM:
			X = fentry->k;
			continue;
		case BPF_S_LD_MEM:
			A = mem[fentry->k];
			continue;
		case BPF_S_LDX_MEM:
			X = mem[fentry->k];
			continue;
		case BPF_S_MISC_TAX:
			X = A;
			continue;
		case BPF_S_MISC_TXA:
			A = X;
			continue;
		case BPF_S_RET_K:
			return fentry->k;
		case BPF_S_RET_A:
			return A;
		case BPF_S_ST:
			mem[fentry->k] = A;
			continue;
		case BPF_S_STX:
			mem[fentry->k] = X;
			continue;
		default:
			WARN_ON(1);
			return 0;
		}

		/*
		 * Handle ancillary data, which are impossible
		 * (or very difficult) to get parsing packet contents.
		 */
		switch (k-SKF_AD_OFF) {
		case SKF_AD_PROTOCOL:
			A = ntohs(skb->protocol);
			continue;
		case SKF_AD_PKTTYPE:
			A = skb->pkt_type;
			continue;
		case SKF_AD_IFINDEX:
			if (!skb->dev)
				return 0;
			A = skb->dev->ifindex;
			continue;
		case SKF_AD_MARK:
			A = skb->mark;
			continue;
		case SKF_AD_QUEUE:
			A = skb->queue_mapping;
			continue;
		case SKF_AD_HATYPE:
			if (!skb->dev)
				return 0;
			A = skb->dev->type;
			continue;
		case SKF_AD_NLATTR: {
			struct nlattr *nla;

			if (skb_is_nonlinear(skb))
				return 0;
			if (A > skb->len - sizeof(struct nlattr))
				return 0;

			nla = nla_find((struct nlattr *)&skb->data[A],
				       skb->len - A, X);
			if (nla)
				A = (void *)nla - (void *)skb->data;
			else
				A = 0;
			continue;
		}
		case SKF_AD_NLATTR_NEST: {
			struct nlattr *nla;

			if (skb_is_nonlinear(skb))
				return 0;
			if (A > skb->len - sizeof(struct nlattr))
				return 0;

			nla = (struct nlattr *)&skb->data[A];
			if (nla->nla_len > A - skb->len)
				return 0;

			nla = nla_find_nested(nla, X);
			if (nla)
				A = (void *)nla - (void *)skb->data;
			else
				A = 0;
			continue;
		}
		default:
			return 0;
		}
	}

	return 0;
}
EXPORT_SYMBOL(sk_run_filter);

/**
 *	sk_chk_filter - verify socket filter code
 *	@filter: filter to verify
 *	@flen: length of filter
 *
 * Check the user's filter code. If we let some ugly
 * filter code slip through kaboom! The filter must contain
 * no references or jumps that are out of range, no illegal
 * instructions, and must end with a RET instruction.
 *
 * All jumps are forward as they are not signed.
 *
 * Returns 0 if the rule set is legal or -EINVAL if not.
 */
int sk_chk_filter(struct sock_filter *filter, int flen)
{
	struct sock_filter *ftest;
	int pc;

	if (flen == 0 || flen > BPF_MAXINSNS)
		return -EINVAL;

	/* check the filter code now */
	for (pc = 0; pc < flen; pc++) {
		ftest = &filter[pc];

		/* Only allow valid instructions */
		switch (ftest->code) {
		case BPF_ALU|BPF_ADD|BPF_K:
			ftest->code = BPF_S_ALU_ADD_K;
			break;
		case BPF_ALU|BPF_ADD|BPF_X:
			ftest->code = BPF_S_ALU_ADD_X;
			break;
		case BPF_ALU|BPF_SUB|BPF_K:
			ftest->code = BPF_S_ALU_SUB_K;
			break;
		case BPF_ALU|BPF_SUB|BPF_X:
			ftest->code = BPF_S_ALU_SUB_X;
			break;
		case BPF_ALU|BPF_MUL|BPF_K:
			ftest->code = BPF_S_ALU_MUL_K;
			break;
		case BPF_ALU|BPF_MUL|BPF_X:
			ftest->code = BPF_S_ALU_MUL_X;
			break;
		case BPF_ALU|BPF_DIV|BPF_X:
			ftest->code = BPF_S_ALU_DIV_X;
			break;
		case BPF_ALU|BPF_AND|BPF_K:
			ftest->code = BPF_S_ALU_AND_K;
			break;
		case BPF_ALU|BPF_AND|BPF_X:
			ftest->code = BPF_S_ALU_AND_X;
			break;
		case BPF_ALU|BPF_OR|BPF_K:
			ftest->code = BPF_S_ALU_OR_K;
			break;
		case BPF_ALU|BPF_OR|BPF_X:
			ftest->code = BPF_S_ALU_OR_X;
			break;
		case BPF_ALU|BPF_LSH|BPF_K:
			ftest->code = BPF_S_ALU_LSH_K;
			break;
		case BPF_ALU|BPF_LSH|BPF_X:
			ftest->code = BPF_S_ALU_LSH_X;
			break;
		case BPF_ALU|BPF_RSH|BPF_K:
			ftest->code = BPF_S_ALU_RSH_K;
			break;
		case BPF_ALU|BPF_RSH|BPF_X:
			ftest->code = BPF_S_ALU_RSH_X;
			break;
		case BPF_ALU|BPF_NEG:
			ftest->code = BPF_S_ALU_NEG;
			break;
		case BPF_LD|BPF_W|BPF_ABS:
			ftest->code = BPF_S_LD_W_ABS;
			break;
		case BPF_LD|BPF_H|BPF_ABS:
			ftest->code = BPF_S_LD_H_ABS;
			break;
		case BPF_LD|BPF_B|BPF_ABS:
			ftest->code = BPF_S_LD_B_ABS;
			break;
		case BPF_LD|BPF_W|BPF_LEN:
			ftest->code = BPF_S_LD_W_LEN;
			break;
		case BPF_LD|BPF_W|BPF_IND:
			ftest->code = BPF_S_LD_W_IND;
			break;
		case BPF_LD|BPF_H|BPF_IND:
			ftest->code = BPF_S_LD_H_IND;
			break;
		case BPF_LD|BPF_B|BPF_IND:
			ftest->code = BPF_S_LD_B_IND;
			break;
		case BPF_LD|BPF_IMM:
			ftest->code = BPF_S_LD_IMM;
			break;
		case BPF_LDX|BPF_W|BPF_LEN:
			ftest->code = BPF_S_LDX_W_LEN;
			break;
		case BPF_LDX|BPF_B|BPF_MSH:
			ftest->code = BPF_S_LDX_B_MSH;
			break;
		case BPF_LDX|BPF_IMM:
			ftest->code = BPF_S_LDX_IMM;
			break;
		case BPF_MISC|BPF_TAX:
			ftest->code = BPF_S_MISC_TAX;
			break;
		case BPF_MISC|BPF_TXA:
			ftest->code = BPF_S_MISC_TXA;
			break;
		case BPF_RET|BPF_K:
			ftest->code = BPF_S_RET_K;
			break;
		case BPF_RET|BPF_A:
			ftest->code = BPF_S_RET_A;
			break;

		/* Some instructions need special checks */

			/* check for division by zero */
		case BPF_ALU|BPF_DIV|BPF_K:
			if (ftest->k == 0)
				return -EINVAL;
			ftest->code = BPF_S_ALU_DIV_K;
			break;

		/* check for invalid memory addresses */
		case BPF_LD|BPF_MEM:
			if (ftest->k >= BPF_MEMWORDS)
				return -EINVAL;
			ftest->code = BPF_S_LD_MEM;
			break;
		case BPF_LDX|BPF_MEM:
			if (ftest->k >= BPF_MEMWORDS)
				return -EINVAL;
			ftest->code = BPF_S_LDX_MEM;
			break;
		case BPF_ST:
			if (ftest->k >= BPF_MEMWORDS)
				return -EINVAL;
			ftest->code = BPF_S_ST;
			break;
		case BPF_STX:
			if (ftest->k >= BPF_MEMWORDS)
				return -EINVAL;
			ftest->code = BPF_S_STX;
			break;

		case BPF_JMP|BPF_JA:
			/*
			 * Note, the large ftest->k might cause loops.
			 * Compare this with conditional jumps below,
			 * where offsets are limited. --ANK (981016)
			 */
			if (ftest->k >= (unsigned)(flen-pc-1))
				return -EINVAL;
			ftest->code = BPF_S_JMP_JA;
			break;

		case BPF_JMP|BPF_JEQ|BPF_K:
			ftest->code = BPF_S_JMP_JEQ_K;
			break;
		case BPF_JMP|BPF_JEQ|BPF_X:
			ftest->code = BPF_S_JMP_JEQ_X;
			break;
		case BPF_JMP|BPF_JGE|BPF_K:
			ftest->code = BPF_S_JMP_JGE_K;
			break;
		case BPF_JMP|BPF_JGE|BPF_X:
			ftest->code = BPF_S_JMP_JGE_X;
			break;
		case BPF_JMP|BPF_JGT|BPF_K:
			ftest->code = BPF_S_JMP_JGT_K;
			break;
		case BPF_JMP|BPF_JGT|BPF_X:
			ftest->code = BPF_S_JMP_JGT_X;
			break;
		case BPF_JMP|BPF_JSET|BPF_K:
			ftest->code = BPF_S_JMP_JSET_K;
			break;
		case BPF_JMP|BPF_JSET|BPF_X:
			ftest->code = BPF_S_JMP_JSET_X;
			break;

		default:
			return -EINVAL;
		}

			/* for conditionals both must be safe */
		switch (ftest->code) {
		case BPF_S_JMP_JEQ_K:
		case BPF_S_JMP_JEQ_X:
		case BPF_S_JMP_JGE_K:
		case BPF_S_JMP_JGE_X:
		case BPF_S_JMP_JGT_K:
		case BPF_S_JMP_JGT_X:
		case BPF_S_JMP_JSET_X:
		case BPF_S_JMP_JSET_K:
			if (pc + ftest->jt + 1 >= flen ||
			    pc + ftest->jf + 1 >= flen)
				return -EINVAL;
		}
	}

	/* last instruction must be a RET code */
	switch (filter[flen - 1].code) {
	case BPF_S_RET_K:
	case BPF_S_RET_A:
		return 0;
		break;
		default:
			return -EINVAL;
		}
}
EXPORT_SYMBOL(sk_chk_filter);

/**
 * 	sk_filter_rcu_release: Release a socket filter by rcu_head
 *	@rcu: rcu_head that contains the sk_filter to free
 */
static void sk_filter_rcu_release(struct rcu_head *rcu)
{
	struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);

	sk_filter_release(fp);
}

static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp)
{
	unsigned int size = sk_filter_len(fp);

	atomic_sub(size, &sk->sk_omem_alloc);
	call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
}

/**
 *	sk_attach_filter - attach a socket filter
 *	@fprog: the filter program
 *	@sk: the socket to use
 *
 * Attach the user's filter code. We first run some sanity checks on
 * it to make sure it does not explode on us later. If an error
 * occurs or there is insufficient memory for the filter a negative
 * errno code is returned. On success the return is zero.
 */
int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
{
	struct sk_filter *fp, *old_fp;
	unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
	int err;

	/* Make sure new filter is there and in the right amounts. */
	if (fprog->filter == NULL)
		return -EINVAL;

	fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
	if (!fp)
		return -ENOMEM;
	if (copy_from_user(fp->insns, fprog->filter, fsize)) {
		sock_kfree_s(sk, fp, fsize+sizeof(*fp));
		return -EFAULT;
	}

	atomic_set(&fp->refcnt, 1);
	fp->len = fprog->len;

	err = sk_chk_filter(fp->insns, fp->len);
	if (err) {
		sk_filter_uncharge(sk, fp);
		return err;
	}

	rcu_read_lock_bh();
	old_fp = rcu_dereference_bh(sk->sk_filter);
	rcu_assign_pointer(sk->sk_filter, fp);
	rcu_read_unlock_bh();

	if (old_fp)
		sk_filter_delayed_uncharge(sk, old_fp);
	return 0;
}
EXPORT_SYMBOL_GPL(sk_attach_filter);

int sk_detach_filter(struct sock *sk)
{
	int ret = -ENOENT;
	struct sk_filter *filter;

	rcu_read_lock_bh();
	filter = rcu_dereference_bh(sk->sk_filter);
	if (filter) {
		rcu_assign_pointer(sk->sk_filter, NULL);
		sk_filter_delayed_uncharge(sk, filter);
		ret = 0;
	}
	rcu_read_unlock_bh();
	return ret;
}
EXPORT_SYMBOL_GPL(sk_detach_filter);
Commit	Line	Data
1da177e4 LT	1	/*
	2	* Linux Socket Filter - Kernel level socket filtering
	3	*
	4	* Author:
	5	* Jay Schulist <jschlst@samba.org>
	6	*
	7	* Based on the design of:
	8	* - The Berkeley Packet Filter
	9	*
	10	* This program is free software; you can redistribute it and/or
	11	* modify it under the terms of the GNU General Public License
	12	* as published by the Free Software Foundation; either version
	13	* 2 of the License, or (at your option) any later version.
	14	*
	15	* Andi Kleen - Fix a few bad bugs and races.
93699863	16	* Kris Katterjohn - Added many additional checks in sk_chk_filter()
1da177e4 LT	17	*/
	18
	19	#include <linux/module.h>
	20	#include <linux/types.h>
1da177e4 LT	21	#include <linux/mm.h>
	22	#include <linux/fcntl.h>
	23	#include <linux/socket.h>
	24	#include <linux/in.h>
	25	#include <linux/inet.h>
	26	#include <linux/netdevice.h>
	27	#include <linux/if_packet.h>
5a0e3ad6	28	#include <linux/gfp.h>
1da177e4 LT	29	#include <net/ip.h>
1da177e4 LT	30	#include <net/protocol.h>
4738c1db	31	#include <net/netlink.h>
1da177e4 LT	32	#include <linux/skbuff.h>
	33	#include <net/sock.h>
	34	#include <linux/errno.h>
	35	#include <linux/timer.h>
	36	#include <asm/system.h>
	37	#include <asm/uaccess.h>
40daafc8	38	#include <asm/unaligned.h>
1da177e4 LT	39	#include <linux/filter.h>
	40
	41	/* No hurry in this branch */
0b05b2a4	42	static void __load_pointer(struct sk_buff skb, int k)
1da177e4 LT	43	{
	44	u8 *ptr = NULL;
	45
	46	if (k >= SKF_NET_OFF)
d56f90a7	47	ptr = skb_network_header(skb) + k - SKF_NET_OFF;
1da177e4	48	else if (k >= SKF_LL_OFF)
98e399f8	49	ptr = skb_mac_header(skb) + k - SKF_LL_OFF;
1da177e4	50
27a884dc	51	if (ptr >= skb->head && ptr < skb_tail_pointer(skb))
1da177e4 LT	52	return ptr;
	53	return NULL;
	54	}
	55
0b05b2a4	56	static inline void load_pointer(struct sk_buff skb, int k,
4ec93edb	57	unsigned int size, void *buffer)
0b05b2a4 PM	58	{
	59	if (k >= 0)
	60	return skb_header_pointer(skb, k, size, buffer);
	61	else {
	62	if (k >= SKF_AD_OFF)
	63	return NULL;
	64	return __load_pointer(skb, k);
	65	}
	66	}
	67
43db6d65 SH	68	/**
	69	* sk_filter - run a packet through a socket filter
	70	* @sk: sock associated with &sk_buff
	71	* @skb: buffer to filter
43db6d65 SH	72	*
	73	* Run the filter code and then cut skb->data to correct size returned by
	74	* sk_run_filter. If pkt_len is 0 we toss packet. If skb->len is smaller
	75	* than pkt_len we keep whole skb->data. This is the socket level
	76	* wrapper to sk_run_filter. It returns 0 if the packet should
	77	* be accepted or -EPERM if the packet should be tossed.
	78	*
	79	*/
	80	int sk_filter(struct sock sk, struct sk_buff skb)
	81	{
	82	int err;
	83	struct sk_filter *filter;
	84
	85	err = security_sock_rcv_skb(sk, skb);
	86	if (err)
	87	return err;
	88
	89	rcu_read_lock_bh();
a898def2	90	filter = rcu_dereference_bh(sk->sk_filter);
43db6d65 SH	91	if (filter) {
	92	unsigned int pkt_len = sk_run_filter(skb, filter->insns,
	93	filter->len);
	94	err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM;
	95	}
	96	rcu_read_unlock_bh();
	97
	98	return err;
	99	}
	100	EXPORT_SYMBOL(sk_filter);
	101
1da177e4	102	/**
2966b66c	103	* sk_run_filter - run a filter on a socket
1da177e4 LT	104	* @skb: buffer to run the filter on
	105	* @filter: filter to apply
	106	* @flen: length of filter
	107	*
	108	* Decode and apply filter instructions to the skb->data.
	109	* Return length to keep, 0 for none. skb is the data we are
	110	* filtering, filter is the array of filter instructions, and
	111	* len is the number of filter blocks in the array.
	112	*/
4bad4dc9	113	unsigned int sk_run_filter(struct sk_buff skb, struct sock_filter filter, int flen)
1da177e4	114	{
1da177e4	115	struct sock_filter fentry; / We walk down these */
0b05b2a4	116	void *ptr;
2966b66c KK	117	u32 A = 0; /* Accumulator */
2966b66c KK	118	u32 X = 0; /* Index Register */
1da177e4	119	u32 mem[BPF_MEMWORDS]; /* Scratch Memory Store */
0b05b2a4	120	u32 tmp;
1da177e4 LT	121	int k;
	122	int pc;
	123
	124	/*
	125	* Process array of filter instructions.
	126	*/
	127	for (pc = 0; pc < flen; pc++) {
	128	fentry = &filter[pc];
4ec93edb	129
1da177e4	130	switch (fentry->code) {
01f2f3f6	131	case BPF_S_ALU_ADD_X:
1da177e4 LT	132	A += X;
1da177e4 LT	133	continue;
01f2f3f6	134	case BPF_S_ALU_ADD_K:
1da177e4 LT	135	A += fentry->k;
1da177e4 LT	136	continue;
01f2f3f6	137	case BPF_S_ALU_SUB_X:
1da177e4 LT	138	A -= X;
1da177e4 LT	139	continue;
01f2f3f6	140	case BPF_S_ALU_SUB_K:
1da177e4 LT	141	A -= fentry->k;
1da177e4 LT	142	continue;
01f2f3f6	143	case BPF_S_ALU_MUL_X:
1da177e4 LT	144	A *= X;
1da177e4 LT	145	continue;
01f2f3f6	146	case BPF_S_ALU_MUL_K:
1da177e4 LT	147	A *= fentry->k;
1da177e4 LT	148	continue;
01f2f3f6	149	case BPF_S_ALU_DIV_X:
1da177e4 LT	150	if (X == 0)
	151	return 0;
	152	A /= X;
	153	continue;
01f2f3f6	154	case BPF_S_ALU_DIV_K:
1da177e4 LT	155	A /= fentry->k;
1da177e4 LT	156	continue;
01f2f3f6	157	case BPF_S_ALU_AND_X:
1da177e4 LT	158	A &= X;
1da177e4 LT	159	continue;
01f2f3f6	160	case BPF_S_ALU_AND_K:
1da177e4 LT	161	A &= fentry->k;
1da177e4 LT	162	continue;
01f2f3f6	163	case BPF_S_ALU_OR_X:
1da177e4 LT	164	A \|= X;
1da177e4 LT	165	continue;
01f2f3f6	166	case BPF_S_ALU_OR_K:
1da177e4 LT	167	A \|= fentry->k;
1da177e4 LT	168	continue;
01f2f3f6	169	case BPF_S_ALU_LSH_X:
1da177e4 LT	170	A <<= X;
1da177e4 LT	171	continue;
01f2f3f6	172	case BPF_S_ALU_LSH_K:
1da177e4 LT	173	A <<= fentry->k;
1da177e4 LT	174	continue;
01f2f3f6	175	case BPF_S_ALU_RSH_X:
1da177e4 LT	176	A >>= X;
1da177e4 LT	177	continue;
01f2f3f6	178	case BPF_S_ALU_RSH_K:
1da177e4 LT	179	A >>= fentry->k;
1da177e4 LT	180	continue;
01f2f3f6	181	case BPF_S_ALU_NEG:
1da177e4 LT	182	A = -A;
1da177e4 LT	183	continue;
01f2f3f6	184	case BPF_S_JMP_JA:
1da177e4 LT	185	pc += fentry->k;
1da177e4 LT	186	continue;
01f2f3f6	187	case BPF_S_JMP_JGT_K:
1da177e4 LT	188	pc += (A > fentry->k) ? fentry->jt : fentry->jf;
1da177e4 LT	189	continue;
01f2f3f6	190	case BPF_S_JMP_JGE_K:
1da177e4 LT	191	pc += (A >= fentry->k) ? fentry->jt : fentry->jf;
1da177e4 LT	192	continue;
01f2f3f6	193	case BPF_S_JMP_JEQ_K:
1da177e4 LT	194	pc += (A == fentry->k) ? fentry->jt : fentry->jf;
1da177e4 LT	195	continue;
01f2f3f6	196	case BPF_S_JMP_JSET_K:
1da177e4 LT	197	pc += (A & fentry->k) ? fentry->jt : fentry->jf;
1da177e4 LT	198	continue;
01f2f3f6	199	case BPF_S_JMP_JGT_X:
1da177e4 LT	200	pc += (A > X) ? fentry->jt : fentry->jf;
1da177e4 LT	201	continue;
01f2f3f6	202	case BPF_S_JMP_JGE_X:
1da177e4 LT	203	pc += (A >= X) ? fentry->jt : fentry->jf;
1da177e4 LT	204	continue;
01f2f3f6	205	case BPF_S_JMP_JEQ_X:
1da177e4 LT	206	pc += (A == X) ? fentry->jt : fentry->jf;
1da177e4 LT	207	continue;
01f2f3f6	208	case BPF_S_JMP_JSET_X:
1da177e4 LT	209	pc += (A & X) ? fentry->jt : fentry->jf;
1da177e4 LT	210	continue;
01f2f3f6	211	case BPF_S_LD_W_ABS:
1da177e4	212	k = fentry->k;
e35bedf3	213	load_w:
0b05b2a4 PM	214	ptr = load_pointer(skb, k, 4, &tmp);
0b05b2a4 PM	215	if (ptr != NULL) {
d3e2ce3b	216	A = get_unaligned_be32(ptr);
0b05b2a4	217	continue;
1da177e4	218	}
1198ad00	219	break;
01f2f3f6	220	case BPF_S_LD_H_ABS:
1da177e4	221	k = fentry->k;
e35bedf3	222	load_h:
0b05b2a4 PM	223	ptr = load_pointer(skb, k, 2, &tmp);
0b05b2a4 PM	224	if (ptr != NULL) {
d3e2ce3b	225	A = get_unaligned_be16(ptr);
0b05b2a4	226	continue;
1da177e4	227	}
1198ad00	228	break;
01f2f3f6	229	case BPF_S_LD_B_ABS:
1da177e4 LT	230	k = fentry->k;
1da177e4 LT	231	load_b:
0b05b2a4 PM	232	ptr = load_pointer(skb, k, 1, &tmp);
	233	if (ptr != NULL) {
	234	A = (u8 )ptr;
	235	continue;
1da177e4	236	}
1198ad00	237	break;
01f2f3f6	238	case BPF_S_LD_W_LEN:
3154e540	239	A = skb->len;
1da177e4	240	continue;
01f2f3f6	241	case BPF_S_LDX_W_LEN:
3154e540	242	X = skb->len;
1da177e4	243	continue;
01f2f3f6	244	case BPF_S_LD_W_IND:
1da177e4 LT	245	k = X + fentry->k;
1da177e4 LT	246	goto load_w;
01f2f3f6	247	case BPF_S_LD_H_IND:
1da177e4 LT	248	k = X + fentry->k;
1da177e4 LT	249	goto load_h;
01f2f3f6	250	case BPF_S_LD_B_IND:
1da177e4 LT	251	k = X + fentry->k;
1da177e4 LT	252	goto load_b;
01f2f3f6	253	case BPF_S_LDX_B_MSH:
0b05b2a4 PM	254	ptr = load_pointer(skb, fentry->k, 1, &tmp);
	255	if (ptr != NULL) {
	256	X = ((u8 )ptr & 0xf) << 2;
	257	continue;
	258	}
	259	return 0;
01f2f3f6	260	case BPF_S_LD_IMM:
1da177e4 LT	261	A = fentry->k;
1da177e4 LT	262	continue;
01f2f3f6	263	case BPF_S_LDX_IMM:
1da177e4 LT	264	X = fentry->k;
1da177e4 LT	265	continue;
01f2f3f6	266	case BPF_S_LD_MEM:
1da177e4 LT	267	A = mem[fentry->k];
1da177e4 LT	268	continue;
01f2f3f6	269	case BPF_S_LDX_MEM:
1da177e4 LT	270	X = mem[fentry->k];
1da177e4 LT	271	continue;
01f2f3f6	272	case BPF_S_MISC_TAX:
1da177e4 LT	273	X = A;
1da177e4 LT	274	continue;
01f2f3f6	275	case BPF_S_MISC_TXA:
1da177e4 LT	276	A = X;
1da177e4 LT	277	continue;
01f2f3f6	278	case BPF_S_RET_K:
4bad4dc9	279	return fentry->k;
01f2f3f6	280	case BPF_S_RET_A:
4bad4dc9	281	return A;
01f2f3f6	282	case BPF_S_ST:
1da177e4 LT	283	mem[fentry->k] = A;
1da177e4 LT	284	continue;
01f2f3f6	285	case BPF_S_STX:
1da177e4 LT	286	mem[fentry->k] = X;
	287	continue;
	288	default:
93699863	289	WARN_ON(1);
1da177e4 LT	290	return 0;
	291	}
	292
	293	/*
	294	* Handle ancillary data, which are impossible
	295	* (or very difficult) to get parsing packet contents.
	296	*/
	297	switch (k-SKF_AD_OFF) {
	298	case SKF_AD_PROTOCOL:
252e3346	299	A = ntohs(skb->protocol);
1da177e4 LT	300	continue;
	301	case SKF_AD_PKTTYPE:
	302	A = skb->pkt_type;
	303	continue;
	304	case SKF_AD_IFINDEX:
40eaf962 PLE	305	if (!skb->dev)
40eaf962 PLE	306	return 0;
1da177e4 LT	307	A = skb->dev->ifindex;
1da177e4 LT	308	continue;
7e75f93e	309	case SKF_AD_MARK:
	310	A = skb->mark;
	311	continue;
d19742fb ED	312	case SKF_AD_QUEUE:
	313	A = skb->queue_mapping;
	314	continue;
40eaf962 PLE	315	case SKF_AD_HATYPE:
	316	if (!skb->dev)
	317	return 0;
	318	A = skb->dev->type;
	319	continue;
4738c1db PM	320	case SKF_AD_NLATTR: {
	321	struct nlattr *nla;
	322
	323	if (skb_is_nonlinear(skb))
	324	return 0;
	325	if (A > skb->len - sizeof(struct nlattr))
	326	return 0;
	327
	328	nla = nla_find((struct nlattr *)&skb->data[A],
	329	skb->len - A, X);
	330	if (nla)
	331	A = (void )nla - (void )skb->data;
	332	else
	333	A = 0;
	334	continue;
	335	}
d214c753 PNA	336	case SKF_AD_NLATTR_NEST: {
	337	struct nlattr *nla;
	338
	339	if (skb_is_nonlinear(skb))
	340	return 0;
	341	if (A > skb->len - sizeof(struct nlattr))
	342	return 0;
	343
	344	nla = (struct nlattr *)&skb->data[A];
	345	if (nla->nla_len > A - skb->len)
	346	return 0;
	347
	348	nla = nla_find_nested(nla, X);
	349	if (nla)
	350	A = (void )nla - (void )skb->data;
	351	else
	352	A = 0;
	353	continue;
	354	}
1da177e4 LT	355	default:
	356	return 0;
	357	}
	358	}
	359
	360	return 0;
	361	}
b715631f	362	EXPORT_SYMBOL(sk_run_filter);
1da177e4 LT	363
	364	/**
	365	* sk_chk_filter - verify socket filter code
	366	* @filter: filter to verify
	367	* @flen: length of filter
	368	*
	369	* Check the user's filter code. If we let some ugly
	370	* filter code slip through kaboom! The filter must contain
93699863 KK	371	* no references or jumps that are out of range, no illegal
93699863 KK	372	* instructions, and must end with a RET instruction.
1da177e4	373	*
7b11f69f KK	374	* All jumps are forward as they are not signed.
	375	*
	376	* Returns 0 if the rule set is legal or -EINVAL if not.
1da177e4 LT	377	*/
	378	int sk_chk_filter(struct sock_filter *filter, int flen)
	379	{
	380	struct sock_filter *ftest;
	381	int pc;
	382
1b93ae64	383	if (flen == 0 \|\| flen > BPF_MAXINSNS)
1da177e4 LT	384	return -EINVAL;
	385
	386	/* check the filter code now */
	387	for (pc = 0; pc < flen; pc++) {
1da177e4	388	ftest = &filter[pc];
1da177e4	389
93699863 KK	390	/* Only allow valid instructions */
	391	switch (ftest->code) {
	392	case BPF_ALU\|BPF_ADD\|BPF_K:
01f2f3f6 HPP	393	ftest->code = BPF_S_ALU_ADD_K;
01f2f3f6 HPP	394	break;
93699863	395	case BPF_ALU\|BPF_ADD\|BPF_X:
01f2f3f6 HPP	396	ftest->code = BPF_S_ALU_ADD_X;
01f2f3f6 HPP	397	break;
93699863	398	case BPF_ALU\|BPF_SUB\|BPF_K:
01f2f3f6 HPP	399	ftest->code = BPF_S_ALU_SUB_K;
01f2f3f6 HPP	400	break;
93699863	401	case BPF_ALU\|BPF_SUB\|BPF_X:
01f2f3f6 HPP	402	ftest->code = BPF_S_ALU_SUB_X;
01f2f3f6 HPP	403	break;
93699863	404	case BPF_ALU\|BPF_MUL\|BPF_K:
01f2f3f6 HPP	405	ftest->code = BPF_S_ALU_MUL_K;
01f2f3f6 HPP	406	break;
93699863	407	case BPF_ALU\|BPF_MUL\|BPF_X:
01f2f3f6 HPP	408	ftest->code = BPF_S_ALU_MUL_X;
01f2f3f6 HPP	409	break;
93699863	410	case BPF_ALU\|BPF_DIV\|BPF_X:
01f2f3f6 HPP	411	ftest->code = BPF_S_ALU_DIV_X;
01f2f3f6 HPP	412	break;
93699863	413	case BPF_ALU\|BPF_AND\|BPF_K:
01f2f3f6 HPP	414	ftest->code = BPF_S_ALU_AND_K;
01f2f3f6 HPP	415	break;
93699863	416	case BPF_ALU\|BPF_AND\|BPF_X:
01f2f3f6 HPP	417	ftest->code = BPF_S_ALU_AND_X;
01f2f3f6 HPP	418	break;
93699863	419	case BPF_ALU\|BPF_OR\|BPF_K:
01f2f3f6 HPP	420	ftest->code = BPF_S_ALU_OR_K;
01f2f3f6 HPP	421	break;
93699863	422	case BPF_ALU\|BPF_OR\|BPF_X:
01f2f3f6 HPP	423	ftest->code = BPF_S_ALU_OR_X;
01f2f3f6 HPP	424	break;
93699863	425	case BPF_ALU\|BPF_LSH\|BPF_K:
01f2f3f6 HPP	426	ftest->code = BPF_S_ALU_LSH_K;
01f2f3f6 HPP	427	break;
93699863	428	case BPF_ALU\|BPF_LSH\|BPF_X:
01f2f3f6 HPP	429	ftest->code = BPF_S_ALU_LSH_X;
01f2f3f6 HPP	430	break;
93699863	431	case BPF_ALU\|BPF_RSH\|BPF_K:
01f2f3f6 HPP	432	ftest->code = BPF_S_ALU_RSH_K;
01f2f3f6 HPP	433	break;
93699863	434	case BPF_ALU\|BPF_RSH\|BPF_X:
01f2f3f6 HPP	435	ftest->code = BPF_S_ALU_RSH_X;
01f2f3f6 HPP	436	break;
93699863	437	case BPF_ALU\|BPF_NEG:
01f2f3f6 HPP	438	ftest->code = BPF_S_ALU_NEG;
01f2f3f6 HPP	439	break;
93699863	440	case BPF_LD\|BPF_W\|BPF_ABS:
01f2f3f6 HPP	441	ftest->code = BPF_S_LD_W_ABS;
01f2f3f6 HPP	442	break;
93699863	443	case BPF_LD\|BPF_H\|BPF_ABS:
01f2f3f6 HPP	444	ftest->code = BPF_S_LD_H_ABS;
01f2f3f6 HPP	445	break;
93699863	446	case BPF_LD\|BPF_B\|BPF_ABS:
01f2f3f6 HPP	447	ftest->code = BPF_S_LD_B_ABS;
01f2f3f6 HPP	448	break;
93699863	449	case BPF_LD\|BPF_W\|BPF_LEN:
01f2f3f6 HPP	450	ftest->code = BPF_S_LD_W_LEN;
01f2f3f6 HPP	451	break;
93699863	452	case BPF_LD\|BPF_W\|BPF_IND:
01f2f3f6 HPP	453	ftest->code = BPF_S_LD_W_IND;
01f2f3f6 HPP	454	break;
93699863	455	case BPF_LD\|BPF_H\|BPF_IND:
01f2f3f6 HPP	456	ftest->code = BPF_S_LD_H_IND;
01f2f3f6 HPP	457	break;
93699863	458	case BPF_LD\|BPF_B\|BPF_IND:
01f2f3f6 HPP	459	ftest->code = BPF_S_LD_B_IND;
01f2f3f6 HPP	460	break;
93699863	461	case BPF_LD\|BPF_IMM:
01f2f3f6 HPP	462	ftest->code = BPF_S_LD_IMM;
01f2f3f6 HPP	463	break;
93699863	464	case BPF_LDX\|BPF_W\|BPF_LEN:
01f2f3f6 HPP	465	ftest->code = BPF_S_LDX_W_LEN;
01f2f3f6 HPP	466	break;
93699863	467	case BPF_LDX\|BPF_B\|BPF_MSH:
01f2f3f6 HPP	468	ftest->code = BPF_S_LDX_B_MSH;
01f2f3f6 HPP	469	break;
93699863	470	case BPF_LDX\|BPF_IMM:
01f2f3f6 HPP	471	ftest->code = BPF_S_LDX_IMM;
01f2f3f6 HPP	472	break;
93699863	473	case BPF_MISC\|BPF_TAX:
01f2f3f6 HPP	474	ftest->code = BPF_S_MISC_TAX;
01f2f3f6 HPP	475	break;
93699863	476	case BPF_MISC\|BPF_TXA:
01f2f3f6 HPP	477	ftest->code = BPF_S_MISC_TXA;
01f2f3f6 HPP	478	break;
93699863	479	case BPF_RET\|BPF_K:
01f2f3f6 HPP	480	ftest->code = BPF_S_RET_K;
01f2f3f6 HPP	481	break;
93699863	482	case BPF_RET\|BPF_A:
01f2f3f6	483	ftest->code = BPF_S_RET_A;
93699863 KK	484	break;
	485
	486	/* Some instructions need special checks */
fb0d366b	487
93699863	488	/* check for division by zero */
01f2f3f6	489	case BPF_ALU\|BPF_DIV\|BPF_K:
93699863	490	if (ftest->k == 0)
1da177e4	491	return -EINVAL;
01f2f3f6	492	ftest->code = BPF_S_ALU_DIV_K;
93699863 KK	493	break;
93699863 KK	494
01f2f3f6	495	/* check for invalid memory addresses */
93699863	496	case BPF_LD\|BPF_MEM:
01f2f3f6 HPP	497	if (ftest->k >= BPF_MEMWORDS)
	498	return -EINVAL;
	499	ftest->code = BPF_S_LD_MEM;
	500	break;
93699863	501	case BPF_LDX\|BPF_MEM:
01f2f3f6 HPP	502	if (ftest->k >= BPF_MEMWORDS)
	503	return -EINVAL;
	504	ftest->code = BPF_S_LDX_MEM;
	505	break;
93699863	506	case BPF_ST:
01f2f3f6 HPP	507	if (ftest->k >= BPF_MEMWORDS)
	508	return -EINVAL;
	509	ftest->code = BPF_S_ST;
	510	break;
93699863	511	case BPF_STX:
93699863 KK	512	if (ftest->k >= BPF_MEMWORDS)
93699863 KK	513	return -EINVAL;
01f2f3f6	514	ftest->code = BPF_S_STX;
93699863 KK	515	break;
	516
	517	case BPF_JMP\|BPF_JA:
	518	/*
	519	* Note, the large ftest->k might cause loops.
	520	* Compare this with conditional jumps below,
	521	* where offsets are limited. --ANK (981016)
	522	*/
	523	if (ftest->k >= (unsigned)(flen-pc-1))
	524	return -EINVAL;
01f2f3f6	525	ftest->code = BPF_S_JMP_JA;
93699863 KK	526	break;
	527
	528	case BPF_JMP\|BPF_JEQ\|BPF_K:
01f2f3f6 HPP	529	ftest->code = BPF_S_JMP_JEQ_K;
01f2f3f6 HPP	530	break;
93699863	531	case BPF_JMP\|BPF_JEQ\|BPF_X:
01f2f3f6 HPP	532	ftest->code = BPF_S_JMP_JEQ_X;
01f2f3f6 HPP	533	break;
93699863	534	case BPF_JMP\|BPF_JGE\|BPF_K:
01f2f3f6 HPP	535	ftest->code = BPF_S_JMP_JGE_K;
01f2f3f6 HPP	536	break;
93699863	537	case BPF_JMP\|BPF_JGE\|BPF_X:
01f2f3f6 HPP	538	ftest->code = BPF_S_JMP_JGE_X;
01f2f3f6 HPP	539	break;
93699863	540	case BPF_JMP\|BPF_JGT\|BPF_K:
01f2f3f6 HPP	541	ftest->code = BPF_S_JMP_JGT_K;
01f2f3f6 HPP	542	break;
93699863	543	case BPF_JMP\|BPF_JGT\|BPF_X:
01f2f3f6 HPP	544	ftest->code = BPF_S_JMP_JGT_X;
01f2f3f6 HPP	545	break;
93699863	546	case BPF_JMP\|BPF_JSET\|BPF_K:
01f2f3f6 HPP	547	ftest->code = BPF_S_JMP_JSET_K;
01f2f3f6 HPP	548	break;
93699863	549	case BPF_JMP\|BPF_JSET\|BPF_X:
01f2f3f6 HPP	550	ftest->code = BPF_S_JMP_JSET_X;
	551	break;
	552
	553	default:
	554	return -EINVAL;
	555	}
	556
93699863	557	/* for conditionals both must be safe */
01f2f3f6 HPP	558	switch (ftest->code) {
	559	case BPF_S_JMP_JEQ_K:
	560	case BPF_S_JMP_JEQ_X:
	561	case BPF_S_JMP_JGE_K:
	562	case BPF_S_JMP_JGE_X:
	563	case BPF_S_JMP_JGT_K:
	564	case BPF_S_JMP_JGT_X:
	565	case BPF_S_JMP_JSET_X:
	566	case BPF_S_JMP_JSET_K:
e35bedf3	567	if (pc + ftest->jt + 1 >= flen \|\|
93699863 KK	568	pc + ftest->jf + 1 >= flen)
93699863 KK	569	return -EINVAL;
01f2f3f6 HPP	570	}
01f2f3f6 HPP	571	}
93699863	572
01f2f3f6 HPP	573	/* last instruction must be a RET code */
	574	switch (filter[flen - 1].code) {
	575	case BPF_S_RET_K:
	576	case BPF_S_RET_A:
	577	return 0;
	578	break;
93699863 KK	579	default:
93699863 KK	580	return -EINVAL;
1da177e4	581	}
1da177e4	582	}
b715631f	583	EXPORT_SYMBOL(sk_chk_filter);
1da177e4	584
47e958ea PE	585	/**
	586	* sk_filter_rcu_release: Release a socket filter by rcu_head
	587	* @rcu: rcu_head that contains the sk_filter to free
	588	*/
	589	static void sk_filter_rcu_release(struct rcu_head *rcu)
	590	{
	591	struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
	592
	593	sk_filter_release(fp);
	594	}
	595
	596	static void sk_filter_delayed_uncharge(struct sock sk, struct sk_filter fp)
	597	{
	598	unsigned int size = sk_filter_len(fp);
	599
	600	atomic_sub(size, &sk->sk_omem_alloc);
	601	call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
	602	}
	603
1da177e4 LT	604	/**
	605	* sk_attach_filter - attach a socket filter
	606	* @fprog: the filter program
	607	* @sk: the socket to use
	608	*
	609	* Attach the user's filter code. We first run some sanity checks on
	610	* it to make sure it does not explode on us later. If an error
	611	* occurs or there is insufficient memory for the filter a negative
	612	* errno code is returned. On success the return is zero.
	613	*/
	614	int sk_attach_filter(struct sock_fprog fprog, struct sock sk)
	615	{
d3904b73	616	struct sk_filter fp, old_fp;
1da177e4 LT	617	unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
	618	int err;
	619
	620	/* Make sure new filter is there and in the right amounts. */
e35bedf3 KK	621	if (fprog->filter == NULL)
e35bedf3 KK	622	return -EINVAL;
1da177e4 LT	623
	624	fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
	625	if (!fp)
	626	return -ENOMEM;
	627	if (copy_from_user(fp->insns, fprog->filter, fsize)) {
4ec93edb	628	sock_kfree_s(sk, fp, fsize+sizeof(*fp));
1da177e4 LT	629	return -EFAULT;
	630	}
	631
	632	atomic_set(&fp->refcnt, 1);
	633	fp->len = fprog->len;
	634
	635	err = sk_chk_filter(fp->insns, fp->len);
d3904b73 PE	636	if (err) {
	637	sk_filter_uncharge(sk, fp);
	638	return err;
1da177e4 LT	639	}
1da177e4 LT	640
d3904b73	641	rcu_read_lock_bh();
a898def2	642	old_fp = rcu_dereference_bh(sk->sk_filter);
d3904b73 PE	643	rcu_assign_pointer(sk->sk_filter, fp);
	644	rcu_read_unlock_bh();
	645
9b013e05 OJ	646	if (old_fp)
9b013e05 OJ	647	sk_filter_delayed_uncharge(sk, old_fp);
d3904b73	648	return 0;
1da177e4	649	}
5ff3f073	650	EXPORT_SYMBOL_GPL(sk_attach_filter);
1da177e4	651
55b33325 PE	652	int sk_detach_filter(struct sock *sk)
	653	{
	654	int ret = -ENOENT;
	655	struct sk_filter *filter;
	656
	657	rcu_read_lock_bh();
a898def2	658	filter = rcu_dereference_bh(sk->sk_filter);
55b33325 PE	659	if (filter) {
55b33325 PE	660	rcu_assign_pointer(sk->sk_filter, NULL);
47e958ea	661	sk_filter_delayed_uncharge(sk, filter);
55b33325 PE	662	ret = 0;
	663	}
	664	rcu_read_unlock_bh();
	665	return ret;
	666	}
5ff3f073	667	EXPORT_SYMBOL_GPL(sk_detach_filter);