In some cases (e.g. seccomp) the program result might be translated from the original program the user supplied. If we're saving the result for checkpoint/restore, we should save exactly the program the user initially supplied.
This causes problems when the translations seccomp makes are not allowed by bpf_check_classic. Signed-off-by: Tycho Andersen <[email protected]> CC: Kees Cook <[email protected]> CC: Will Drewry <[email protected]> CC: Oleg Nesterov <[email protected]> CC: Andy Lutomirski <[email protected]> CC: Pavel Emelyanov <[email protected]> CC: Serge E. Hallyn <[email protected]> CC: Alexei Starovoitov <[email protected]> CC: Daniel Borkmann <[email protected]> --- net/core/filter.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 70995dd..5a4596b 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -845,8 +845,7 @@ int bpf_prog_store_orig_filter(struct bpf_prog *fp, fkprog = fp->orig_prog; fkprog->len = fprog->len; - fkprog->filter = kmemdup(fp->insns, fsize, - GFP_KERNEL | __GFP_NOWARN); + fkprog->filter = memdup_user(fprog->filter, fsize); if (!fkprog->filter) { kfree(fp->orig_prog); return -ENOMEM; -- 2.5.0 -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
