Hello, Donjuanplatinum, le mer. 23 sept. 2026 13:55:12 +0800, a ecrit: > > Hi, > > This patch adds validation for the filter count before processing the > filter. > > A filter count of zero or a value largger than the `NET_MAX_FILTER` is > rejected with `D_INVALID_OPERATION`.
Applied, thanks! Samuel > From 5f5a376cde4caad0fbaf71589ac37470462ac7d2 Mon Sep 17 00:00:00 2001 > From: Donjuanplatinum <[email protected]> > Date: Wed, 23 Sep 2026 13:45:26 +0800 > Subject: [PATCH] libbpf: add filter count check > > --- > libbpf/bpf_impl.c | 10 +++++++--- > 1 file changed, 7 insertions(+), 3 deletions(-) > > diff --git a/libbpf/bpf_impl.c b/libbpf/bpf_impl.c > index df64d4c1..ed17632d 100644 > --- a/libbpf/bpf_impl.c > +++ b/libbpf/bpf_impl.c > @@ -636,14 +636,18 @@ net_set_filter(if_filter_list_t *ifp, mach_port_t > rcv_port, int priority, > > /* Check the filter syntax. */ > > + /* Reject filters which are zero or overflow */ > + if (filter_count == 0 || filter_count > NET_MAX_FILTER) { > + debug ("invalid filter_count: %d\n", filter_count); > + return (D_INVALID_OPERATION); > + } > + > debug ("filter_count: %d, filter[0]: %d\n", filter_count, filter[0]); > > filter_bytes = CSPF_BYTES (filter_count); > match = (bpf_insn_t) 0; > > - if (filter_count == 0) { > - return (D_INVALID_OPERATION); > - } else if (!((filter[0] & NETF_IN) || (filter[0] & NETF_OUT))) { > + if (!((filter[0] & NETF_IN) || (filter[0] & NETF_OUT))) { > return (D_INVALID_OPERATION); /* NETF_IN or NETF_OUT required */ > } else if ((filter[0] & NETF_TYPE_MASK) == NETF_BPF) { > ret = bpf_validate((bpf_insn_t)filter, filter_bytes, &match); > -- > 2.55.0 > > From 8efc0e9e1c1e3533155e75afd91de91010315573 Mon Sep 17 00:00:00 2001 > From: Donjuanplatinum <[email protected]> > Date: Wed, 23 Sep 2026 13:45:42 +0800 > Subject: [PATCH] libbpf: add filter count check > > --- > device/net_io.c | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > > diff --git a/device/net_io.c b/device/net_io.c > index 60607537..d1dd7255 100644 > --- a/device/net_io.c > +++ b/device/net_io.c > @@ -1110,12 +1110,15 @@ net_set_filter( > * Check the filter syntax. > */ > > + /* Reject filters which are zero or overflow */ > + if (filter_count == 0 || filter_count > NET_MAX_FILTER) { > + return (D_INVALID_OPERATION); > + } > + > filter_bytes = CSPF_BYTES(filter_count); > match = (bpf_insn_t) 0; > > - if (filter_count == 0) { > - return (D_INVALID_OPERATION); > - } else if (!((filter[0] & NETF_IN) || (filter[0] & NETF_OUT))) { > + if (!((filter[0] & NETF_IN) || (filter[0] & NETF_OUT))) { > return (D_INVALID_OPERATION); /* NETF_IN or NETF_OUT required */ > } else if ((filter[0] & NETF_TYPE_MASK) == NETF_BPF) { > ret = bpf_validate((bpf_insn_t)filter, filter_bytes, &match); > @@ -2177,4 +2180,3 @@ net_free_dead_entp(queue_entry_t dead_entp) > kmem_cache_free(&net_hash_entry_cache, (vm_offset_t) entp); > } > } > - > -- > 2.55.0 > -- Samuel > ±z¬O§_¸g±`¬°¦p¦ó©Ý®i¦æ¾PºÞ¹D¶Ë¸£µ¬? > ¥Zµn³ø¯È,Âø»x¼s§i©Î¶l±H¢Ò¢Û (Direct Mail)¬O§_¤w¸gµLªk¹F¦¨±z¹w´Áªº¼s§i®ÄªG? Je vous invite a consulter dans un premier temps le french-Howto. -+- JCD in Guide du linuxien pervers - "Bien configurer la lisibilité de fcolm"
