net/core/filter.c

   1 /*
   2  * Linux Socket Filter - Kernel level socket filtering
   3  *
   4  * Author:
   5  *     Jay Schulist <jschlst@samba.org>
   6  *
   7  * Based on the design of:
   8  *     - The Berkeley Packet Filter
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License
  12  * as published by the Free Software Foundation; either version
  13  * 2 of the License, or (at your option) any later version.
  14  *
  15  * Andi Kleen - Fix a few bad bugs and races.
  16  * Kris Katterjohn - Added many additional checks in sk_chk_filter()
  17  */
  18
  19 #include <linux/module.h>
  20 #include <linux/types.h>
  21 #include <linux/mm.h>
  22 #include <linux/fcntl.h>
  23 #include <linux/socket.h>
  24 #include <linux/in.h>
  25 #include <linux/inet.h>
  26 #include <linux/netdevice.h>
  27 #include <linux/if_packet.h>
  28 #include <linux/gfp.h>
  29 #include <net/ip.h>
  30 #include <net/protocol.h>
  31 #include <net/netlink.h>
  32 #include <linux/skbuff.h>
  33 #include <net/sock.h>
  34 #include <linux/errno.h>
  35 #include <linux/timer.h>
  36 #include <asm/system.h>
  37 #include <asm/uaccess.h>
  38 #include <asm/unaligned.h>
  39 #include <linux/filter.h>
  40
  41 enum {
  42         BPF_S_RET_K = 0,
  43         BPF_S_RET_A,
  44         BPF_S_ALU_ADD_K,
  45         BPF_S_ALU_ADD_X,
  46         BPF_S_ALU_SUB_K,
  47         BPF_S_ALU_SUB_X,
  48         BPF_S_ALU_MUL_K,
  49         BPF_S_ALU_MUL_X,
  50         BPF_S_ALU_DIV_X,
  51         BPF_S_ALU_AND_K,
  52         BPF_S_ALU_AND_X,
  53         BPF_S_ALU_OR_K,
  54         BPF_S_ALU_OR_X,
  55         BPF_S_ALU_LSH_K,
  56         BPF_S_ALU_LSH_X,
  57         BPF_S_ALU_RSH_K,
  58         BPF_S_ALU_RSH_X,
  59         BPF_S_ALU_NEG,
  60         BPF_S_LD_W_ABS,
  61         BPF_S_LD_H_ABS,
  62         BPF_S_LD_B_ABS,
  63         BPF_S_LD_W_LEN,
  64         BPF_S_LD_W_IND,
  65         BPF_S_LD_H_IND,
  66         BPF_S_LD_B_IND,
  67         BPF_S_LD_IMM,
  68         BPF_S_LDX_W_LEN,
  69         BPF_S_LDX_B_MSH,
  70         BPF_S_LDX_IMM,
  71         BPF_S_MISC_TAX,
  72         BPF_S_MISC_TXA,
  73         BPF_S_ALU_DIV_K,
  74         BPF_S_LD_MEM,
  75         BPF_S_LDX_MEM,
  76         BPF_S_ST,
  77         BPF_S_STX,
  78         BPF_S_JMP_JA,
  79         BPF_S_JMP_JEQ_K,
  80         BPF_S_JMP_JEQ_X,
  81         BPF_S_JMP_JGE_K,
  82         BPF_S_JMP_JGE_X,
  83         BPF_S_JMP_JGT_K,
  84         BPF_S_JMP_JGT_X,
  85         BPF_S_JMP_JSET_K,
  86         BPF_S_JMP_JSET_X,
  87 };
  88
  89 /* No hurry in this branch */
  90 static void *__load_pointer(struct sk_buff *skb, int k)
  91 {
  92         u8 *ptr = NULL;
  93
  94         if (k >= SKF_NET_OFF)
  95                 ptr = skb_network_header(skb) + k - SKF_NET_OFF;
  96         else if (k >= SKF_LL_OFF)
  97                 ptr = skb_mac_header(skb) + k - SKF_LL_OFF;
  98
  99         if (ptr >= skb->head && ptr < skb_tail_pointer(skb))
 100                 return ptr;
 101         return NULL;
 102 }
 103
 104 static inline void *load_pointer(struct sk_buff *skb, int k,
 105                                  unsigned int size, void *buffer)
 106 {
 107         if (k >= 0)
 108                 return skb_header_pointer(skb, k, size, buffer);
 109         else {
 110                 if (k >= SKF_AD_OFF)
 111                         return NULL;
 112                 return __load_pointer(skb, k);
 113         }
 114 }
 115
 116 /**
 117  *      sk_filter - run a packet through a socket filter
 118  *      @sk: sock associated with &sk_buff
 119  *      @skb: buffer to filter
 120  *
 121  * Run the filter code and then cut skb->data to correct size returned by
 122  * sk_run_filter. If pkt_len is 0 we toss packet. If skb->len is smaller
 123  * than pkt_len we keep whole skb->data. This is the socket level
 124  * wrapper to sk_run_filter. It returns 0 if the packet should
 125  * be accepted or -EPERM if the packet should be tossed.
 126  *
 127  */
 128 int sk_filter(struct sock *sk, struct sk_buff *skb)
 129 {
 130         int err;
 131         struct sk_filter *filter;
 132
 133         err = security_sock_rcv_skb(sk, skb);
 134         if (err)
 135                 return err;
 136
 137         rcu_read_lock_bh();
 138         filter = rcu_dereference_bh(sk->sk_filter);
 139         if (filter) {
 140                 unsigned int pkt_len = sk_run_filter(skb, filter->insns, filter->len);
 141
 142                 err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM;
 143         }
 144         rcu_read_unlock_bh();
 145
 146         return err;
 147 }
 148 EXPORT_SYMBOL(sk_filter);
 149
 150 /**
 151  *      sk_run_filter - run a filter on a socket
 152  *      @skb: buffer to run the filter on
 153  *      @filter: filter to apply
 154  *      @flen: length of filter
 155  *
 156  * Decode and apply filter instructions to the skb->data.
 157  * Return length to keep, 0 for none. skb is the data we are
 158  * filtering, filter is the array of filter instructions, and
 159  * len is the number of filter blocks in the array.
 160  */
 161 unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
 162 {
 163         void *ptr;
 164         u32 A = 0;                      /* Accumulator */
 165         u32 X = 0;                      /* Index Register */
 166         u32 mem[BPF_MEMWORDS];          /* Scratch Memory Store */
 167         unsigned long memvalid = 0;
 168         u32 tmp;
 169         int k;
 170         int pc;
 171
 172         BUILD_BUG_ON(BPF_MEMWORDS > BITS_PER_LONG);
 173         /*
 174          * Process array of filter instructions.
 175          */
 176         for (pc = 0; pc < flen; pc++) {
 177                 const struct sock_filter *fentry = &filter[pc];
 178                 u32 f_k = fentry->k;
 179
 180                 switch (fentry->code) {
 181                 case BPF_S_ALU_ADD_X:
 182                         A += X;
 183                         continue;
 184                 case BPF_S_ALU_ADD_K:
 185                         A += f_k;
 186                         continue;
 187                 case BPF_S_ALU_SUB_X:
 188                         A -= X;
 189                         continue;
 190                 case BPF_S_ALU_SUB_K:
 191                         A -= f_k;
 192                         continue;
 193                 case BPF_S_ALU_MUL_X:
 194                         A *= X;
 195                         continue;
 196                 case BPF_S_ALU_MUL_K:
 197                         A *= f_k;
 198                         continue;
 199                 case BPF_S_ALU_DIV_X:
 200                         if (X == 0)
 201                                 return 0;
 202                         A /= X;
 203                         continue;
 204                 case BPF_S_ALU_DIV_K:
 205                         A /= f_k;
 206                         continue;
 207                 case BPF_S_ALU_AND_X:
 208                         A &= X;
 209                         continue;
 210                 case BPF_S_ALU_AND_K:
 211                         A &= f_k;
 212                         continue;
 213                 case BPF_S_ALU_OR_X:
 214                         A |= X;
 215                         continue;
 216                 case BPF_S_ALU_OR_K:
 217                         A |= f_k;
 218                         continue;
 219                 case BPF_S_ALU_LSH_X:
 220                         A <<= X;
 221                         continue;
 222                 case BPF_S_ALU_LSH_K:
 223                         A <<= f_k;
 224                         continue;
 225                 case BPF_S_ALU_RSH_X:
 226                         A >>= X;
 227                         continue;
 228                 case BPF_S_ALU_RSH_K:
 229                         A >>= f_k;
 230                         continue;
 231                 case BPF_S_ALU_NEG:
 232                         A = -A;
 233                         continue;
 234                 case BPF_S_JMP_JA:
 235                         pc += f_k;
 236                         continue;
 237                 case BPF_S_JMP_JGT_K:
 238                         pc += (A > f_k) ? fentry->jt : fentry->jf;
 239                         continue;
 240                 case BPF_S_JMP_JGE_K:
 241                         pc += (A >= f_k) ? fentry->jt : fentry->jf;
 242                         continue;
 243                 case BPF_S_JMP_JEQ_K:
 244                         pc += (A == f_k) ? fentry->jt : fentry->jf;
 245                         continue;
 246                 case BPF_S_JMP_JSET_K:
 247                         pc += (A & f_k) ? fentry->jt : fentry->jf;
 248                         continue;
 249                 case BPF_S_JMP_JGT_X:
 250                         pc += (A > X) ? fentry->jt : fentry->jf;
 251                         continue;
 252                 case BPF_S_JMP_JGE_X:
 253                         pc += (A >= X) ? fentry->jt : fentry->jf;
 254                         continue;
 255                 case BPF_S_JMP_JEQ_X:
 256                         pc += (A == X) ? fentry->jt : fentry->jf;
 257                         continue;
 258                 case BPF_S_JMP_JSET_X:
 259                         pc += (A & X) ? fentry->jt : fentry->jf;
 260                         continue;
 261                 case BPF_S_LD_W_ABS:
 262                         k = f_k;
 263 load_w:
 264                         ptr = load_pointer(skb, k, 4, &tmp);
 265                         if (ptr != NULL) {
 266                                 A = get_unaligned_be32(ptr);
 267                                 continue;
 268                         }
 269                         break;
 270                 case BPF_S_LD_H_ABS:
 271                         k = f_k;
 272 load_h:
 273                         ptr = load_pointer(skb, k, 2, &tmp);
 274                         if (ptr != NULL) {
 275                                 A = get_unaligned_be16(ptr);
 276                                 continue;
 277                         }
 278                         break;
 279                 case BPF_S_LD_B_ABS:
 280                         k = f_k;
 281 load_b:
 282                         ptr = load_pointer(skb, k, 1, &tmp);
 283                         if (ptr != NULL) {
 284                                 A = *(u8 *)ptr;
 285                                 continue;
 286                         }
 287                         break;
 288                 case BPF_S_LD_W_LEN:
 289                         A = skb->len;
 290                         continue;
 291                 case BPF_S_LDX_W_LEN:
 292                         X = skb->len;
 293                         continue;
 294                 case BPF_S_LD_W_IND:
 295                         k = X + f_k;
 296                         goto load_w;
 297                 case BPF_S_LD_H_IND:
 298                         k = X + f_k;
 299                         goto load_h;
 300                 case BPF_S_LD_B_IND:
 301                         k = X + f_k;
 302                         goto load_b;
 303                 case BPF_S_LDX_B_MSH:
 304                         ptr = load_pointer(skb, f_k, 1, &tmp);
 305                         if (ptr != NULL) {
 306                                 X = (*(u8 *)ptr & 0xf) << 2;
 307                                 continue;
 308                         }
 309                         return 0;
 310                 case BPF_S_LD_IMM:
 311                         A = f_k;
 312                         continue;
 313                 case BPF_S_LDX_IMM:
 314                         X = f_k;
 315                         continue;
 316                 case BPF_S_LD_MEM:
 317                         A = (memvalid & (1UL << f_k)) ?
 318                                 mem[f_k] : 0;
 319                         continue;
 320                 case BPF_S_LDX_MEM:
 321                         X = (memvalid & (1UL << f_k)) ?
 322                                 mem[f_k] : 0;
 323                         continue;
 324                 case BPF_S_MISC_TAX:
 325                         X = A;
 326                         continue;
 327                 case BPF_S_MISC_TXA:
 328                         A = X;
 329                         continue;
 330                 case BPF_S_RET_K:
 331                         return f_k;
 332                 case BPF_S_RET_A:
 333                         return A;
 334                 case BPF_S_ST:
 335                         memvalid |= 1UL << f_k;
 336                         mem[f_k] = A;
 337                         continue;
 338                 case BPF_S_STX:
 339                         memvalid |= 1UL << f_k;
 340                         mem[f_k] = X;
 341                         continue;
 342                 default:
 343                         WARN_ON(1);
 344                         return 0;
 345                 }
 346
 347                 /*
 348                  * Handle ancillary data, which are impossible
 349                  * (or very difficult) to get parsing packet contents.
 350                  */
 351                 switch (k-SKF_AD_OFF) {
 352                 case SKF_AD_PROTOCOL:
 353                         A = ntohs(skb->protocol);
 354                         continue;
 355                 case SKF_AD_PKTTYPE:
 356                         A = skb->pkt_type;
 357                         continue;
 358                 case SKF_AD_IFINDEX:
 359                         if (!skb->dev)
 360                                 return 0;
 361                         A = skb->dev->ifindex;
 362                         continue;
 363                 case SKF_AD_MARK:
 364                         A = skb->mark;
 365                         continue;
 366                 case SKF_AD_QUEUE:
 367                         A = skb->queue_mapping;
 368                         continue;
 369                 case SKF_AD_HATYPE:
 370                         if (!skb->dev)
 371                                 return 0;
 372                         A = skb->dev->type;
 373                         continue;
 374                 case SKF_AD_NLATTR: {
 375                         struct nlattr *nla;
 376
 377                         if (skb_is_nonlinear(skb))
 378                                 return 0;
 379                         if (A > skb->len - sizeof(struct nlattr))
 380                                 return 0;
 381
 382                         nla = nla_find((struct nlattr *)&skb->data[A],
 383                                        skb->len - A, X);
 384                         if (nla)
 385                                 A = (void *)nla - (void *)skb->data;
 386                         else
 387                                 A = 0;
 388                         continue;
 389                 }
 390                 case SKF_AD_NLATTR_NEST: {
 391                         struct nlattr *nla;
 392
 393                         if (skb_is_nonlinear(skb))
 394                                 return 0;
 395                         if (A > skb->len - sizeof(struct nlattr))
 396                                 return 0;
 397
 398                         nla = (struct nlattr *)&skb->data[A];
 399                         if (nla->nla_len > A - skb->len)
 400                                 return 0;
 401
 402                         nla = nla_find_nested(nla, X);
 403                         if (nla)
 404                                 A = (void *)nla - (void *)skb->data;
 405                         else
 406                                 A = 0;
 407                         continue;
 408                 }
 409                 default:
 410                         return 0;
 411                 }
 412         }
 413
 414         return 0;
 415 }
 416 EXPORT_SYMBOL(sk_run_filter);
 417
 418 /**
 419  *      sk_chk_filter - verify socket filter code
 420  *      @filter: filter to verify
 421  *      @flen: length of filter
 422  *
 423  * Check the user's filter code. If we let some ugly
 424  * filter code slip through kaboom! The filter must contain
 425  * no references or jumps that are out of range, no illegal
 426  * instructions, and must end with a RET instruction.
 427  *
 428  * All jumps are forward as they are not signed.
 429  *
 430  * Returns 0 if the rule set is legal or -EINVAL if not.
 431  */
 432 int sk_chk_filter(struct sock_filter *filter, int flen)
 433 {
 434         /*
 435          * Valid instructions are initialized to non-0.
 436          * Invalid instructions are initialized to 0.
 437          */
 438         static const u8 codes[] = {
 439                 [BPF_ALU|BPF_ADD|BPF_K]  = BPF_S_ALU_ADD_K + 1,
 440                 [BPF_ALU|BPF_ADD|BPF_X]  = BPF_S_ALU_ADD_X + 1,
 441                 [BPF_ALU|BPF_SUB|BPF_K]  = BPF_S_ALU_SUB_K + 1,
 442                 [BPF_ALU|BPF_SUB|BPF_X]  = BPF_S_ALU_SUB_X + 1,
 443                 [BPF_ALU|BPF_MUL|BPF_K]  = BPF_S_ALU_MUL_K + 1,
 444                 [BPF_ALU|BPF_MUL|BPF_X]  = BPF_S_ALU_MUL_X + 1,
 445                 [BPF_ALU|BPF_DIV|BPF_X]  = BPF_S_ALU_DIV_X + 1,
 446                 [BPF_ALU|BPF_AND|BPF_K]  = BPF_S_ALU_AND_K + 1,
 447                 [BPF_ALU|BPF_AND|BPF_X]  = BPF_S_ALU_AND_X + 1,
 448                 [BPF_ALU|BPF_OR|BPF_K]   = BPF_S_ALU_OR_K + 1,
 449                 [BPF_ALU|BPF_OR|BPF_X]   = BPF_S_ALU_OR_X + 1,
 450                 [BPF_ALU|BPF_LSH|BPF_K]  = BPF_S_ALU_LSH_K + 1,
 451                 [BPF_ALU|BPF_LSH|BPF_X]  = BPF_S_ALU_LSH_X + 1,
 452                 [BPF_ALU|BPF_RSH|BPF_K]  = BPF_S_ALU_RSH_K + 1,
 453                 [BPF_ALU|BPF_RSH|BPF_X]  = BPF_S_ALU_RSH_X + 1,
 454                 [BPF_ALU|BPF_NEG]        = BPF_S_ALU_NEG + 1,
 455                 [BPF_LD|BPF_W|BPF_ABS]   = BPF_S_LD_W_ABS + 1,
 456                 [BPF_LD|BPF_H|BPF_ABS]   = BPF_S_LD_H_ABS + 1,
 457                 [BPF_LD|BPF_B|BPF_ABS]   = BPF_S_LD_B_ABS + 1,
 458                 [BPF_LD|BPF_W|BPF_LEN]   = BPF_S_LD_W_LEN + 1,
 459                 [BPF_LD|BPF_W|BPF_IND]   = BPF_S_LD_W_IND + 1,
 460                 [BPF_LD|BPF_H|BPF_IND]   = BPF_S_LD_H_IND + 1,
 461                 [BPF_LD|BPF_B|BPF_IND]   = BPF_S_LD_B_IND + 1,
 462                 [BPF_LD|BPF_IMM]         = BPF_S_LD_IMM + 1,
 463                 [BPF_LDX|BPF_W|BPF_LEN]  = BPF_S_LDX_W_LEN + 1,
 464                 [BPF_LDX|BPF_B|BPF_MSH]  = BPF_S_LDX_B_MSH + 1,
 465                 [BPF_LDX|BPF_IMM]        = BPF_S_LDX_IMM + 1,
 466                 [BPF_MISC|BPF_TAX]       = BPF_S_MISC_TAX + 1,
 467                 [BPF_MISC|BPF_TXA]       = BPF_S_MISC_TXA + 1,
 468                 [BPF_RET|BPF_K]          = BPF_S_RET_K + 1,
 469                 [BPF_RET|BPF_A]          = BPF_S_RET_A + 1,
 470                 [BPF_ALU|BPF_DIV|BPF_K]  = BPF_S_ALU_DIV_K + 1,
 471                 [BPF_LD|BPF_MEM]         = BPF_S_LD_MEM + 1,
 472                 [BPF_LDX|BPF_MEM]        = BPF_S_LDX_MEM + 1,
 473                 [BPF_ST]                 = BPF_S_ST + 1,
 474                 [BPF_STX]                = BPF_S_STX + 1,
 475                 [BPF_JMP|BPF_JA]         = BPF_S_JMP_JA + 1,
 476                 [BPF_JMP|BPF_JEQ|BPF_K]  = BPF_S_JMP_JEQ_K + 1,
 477                 [BPF_JMP|BPF_JEQ|BPF_X]  = BPF_S_JMP_JEQ_X + 1,
 478                 [BPF_JMP|BPF_JGE|BPF_K]  = BPF_S_JMP_JGE_K + 1,
 479                 [BPF_JMP|BPF_JGE|BPF_X]  = BPF_S_JMP_JGE_X + 1,
 480                 [BPF_JMP|BPF_JGT|BPF_K]  = BPF_S_JMP_JGT_K + 1,
 481                 [BPF_JMP|BPF_JGT|BPF_X]  = BPF_S_JMP_JGT_X + 1,
 482                 [BPF_JMP|BPF_JSET|BPF_K] = BPF_S_JMP_JSET_K + 1,
 483                 [BPF_JMP|BPF_JSET|BPF_X] = BPF_S_JMP_JSET_X + 1,
 484         };
 485         int pc;
 486
 487         if (flen == 0 || flen > BPF_MAXINSNS)
 488                 return -EINVAL;
 489
 490         /* check the filter code now */
 491         for (pc = 0; pc < flen; pc++) {
 492                 struct sock_filter *ftest = &filter[pc];
 493                 u16 code = ftest->code;
 494
 495                 if (code >= ARRAY_SIZE(codes))
 496                         return -EINVAL;
 497                 code = codes[code];
 498                 /* Undo the '+ 1' in codes[] after validation. */
 499                 if (!code--)
 500                         return -EINVAL;
 501                 /* Some instructions need special checks */
 502                 switch (code) {
 503                 case BPF_S_ALU_DIV_K:
 504                         /* check for division by zero */
 505                         if (ftest->k == 0)
 506                                 return -EINVAL;
 507                         break;
 508                 case BPF_S_LD_MEM:
 509                 case BPF_S_LDX_MEM:
 510                 case BPF_S_ST:
 511                 case BPF_S_STX:
 512                         /* check for invalid memory addresses */
 513                         if (ftest->k >= BPF_MEMWORDS)
 514                                 return -EINVAL;
 515                         break;
 516                 case BPF_S_JMP_JA:
 517                         /*
 518                          * Note, the large ftest->k might cause loops.
 519                          * Compare this with conditional jumps below,
 520                          * where offsets are limited. --ANK (981016)
 521                          */
 522                         if (ftest->k >= (unsigned)(flen-pc-1))
 523                                 return -EINVAL;
 524                         break;
 525                 case BPF_S_JMP_JEQ_K:
 526                 case BPF_S_JMP_JEQ_X:
 527                 case BPF_S_JMP_JGE_K:
 528                 case BPF_S_JMP_JGE_X:
 529                 case BPF_S_JMP_JGT_K:
 530                 case BPF_S_JMP_JGT_X:
 531                 case BPF_S_JMP_JSET_X:
 532                 case BPF_S_JMP_JSET_K:
 533                         /* for conditionals both must be safe */
 534                         if (pc + ftest->jt + 1 >= flen ||
 535                             pc + ftest->jf + 1 >= flen)
 536                                 return -EINVAL;
 537                         break;
 538                 }
 539                 ftest->code = code;
 540         }
 541
 542         /* last instruction must be a RET code */
 543         switch (filter[flen - 1].code) {
 544         case BPF_S_RET_K:
 545         case BPF_S_RET_A:
 546                 return 0;
 547         }
 548         return -EINVAL;
 549 }
 550 EXPORT_SYMBOL(sk_chk_filter);
 551
 552 /**
 553  *      sk_filter_rcu_release: Release a socket filter by rcu_head
 554  *      @rcu: rcu_head that contains the sk_filter to free
 555  */
 556 static void sk_filter_rcu_release(struct rcu_head *rcu)
 557 {
 558         struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
 559
 560         sk_filter_release(fp);
 561 }
 562
 563 static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp)
 564 {
 565         unsigned int size = sk_filter_len(fp);
 566
 567         atomic_sub(size, &sk->sk_omem_alloc);
 568         call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
 569 }
 570
 571 /**
 572  *      sk_attach_filter - attach a socket filter
 573  *      @fprog: the filter program
 574  *      @sk: the socket to use
 575  *
 576  * Attach the user's filter code. We first run some sanity checks on
 577  * it to make sure it does not explode on us later. If an error
 578  * occurs or there is insufficient memory for the filter a negative
 579  * errno code is returned. On success the return is zero.
 580  */
 581 int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
 582 {
 583         struct sk_filter *fp, *old_fp;
 584         unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
 585         int err;
 586
 587         /* Make sure new filter is there and in the right amounts. */
 588         if (fprog->filter == NULL)
 589                 return -EINVAL;
 590
 591         fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
 592         if (!fp)
 593                 return -ENOMEM;
 594         if (copy_from_user(fp->insns, fprog->filter, fsize)) {
 595                 sock_kfree_s(sk, fp, fsize+sizeof(*fp));
 596                 return -EFAULT;
 597         }
 598
 599         atomic_set(&fp->refcnt, 1);
 600         fp->len = fprog->len;
 601
 602         err = sk_chk_filter(fp->insns, fp->len);
 603         if (err) {
 604                 sk_filter_uncharge(sk, fp);
 605                 return err;
 606         }
 607
 608         old_fp = rcu_dereference_protected(sk->sk_filter,
 609                                            sock_owned_by_user(sk));
 610         rcu_assign_pointer(sk->sk_filter, fp);
 611
 612         if (old_fp)
 613                 sk_filter_delayed_uncharge(sk, old_fp);
 614         return 0;
 615 }
 616 EXPORT_SYMBOL_GPL(sk_attach_filter);
 617
 618 int sk_detach_filter(struct sock *sk)
 619 {
 620         int ret = -ENOENT;
 621         struct sk_filter *filter;
 622
 623         filter = rcu_dereference_protected(sk->sk_filter,
 624                                            sock_owned_by_user(sk));
 625         if (filter) {
 626                 rcu_assign_pointer(sk->sk_filter, NULL);
 627                 sk_filter_delayed_uncharge(sk, filter);
 628                 ret = 0;
 629         }
 630         return ret;
 631 }
 632 EXPORT_SYMBOL_GPL(sk_detach_filter);