3 files changed, 41 insertions, 2 deletions

diff --git a/include/net/compat.h b/include/net/compat.h
index 48103cf94e97..13de0ccaa059 100644
--- a/include/net/compat.h
+++ b/include/net/compat.h
@@ -42,6 +42,7 @@ int compat_sock_get_timestampns(struct sock *, struct timespec __user *);
 
 int get_compat_msghdr(struct msghdr *, struct compat_msghdr __user *,
                       struct sockaddr __user **, struct iovec **);
+struct sock_fprog __user *get_compat_bpf_fprog(char __user *optval);
 asmlinkage long compat_sys_sendmsg(int, struct compat_msghdr __user *,
                                    unsigned int);
 asmlinkage long compat_sys_sendmmsg(int, struct compat_mmsghdr __user *,
diff --git a/net/compat.c b/net/compat.c
index 1373947efb50..1cd2ec046164 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -309,8 +309,8 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
         __scm_destroy(scm);
 }
 
-static int do_set_attach_filter(struct socket *sock, int level, int optname,
-                                char __user *optval, unsigned int optlen)
+/* allocate a 64-bit sock_fprog on the user stack for duration of syscall. */
+struct sock_fprog __user *get_compat_bpf_fprog(char __user *optval)
 {
         struct compat_sock_fprog __user *fprog32 = (struct compat_sock_fprog __user *)optval;
         struct sock_fprog __user *kfprog = compat_alloc_user_space(sizeof(struct sock_fprog));
@@ -323,6 +323,19 @@ static int do_set_attach_filter(struct socket *sock, int level, int optname,
             __get_user(ptr, &fprog32->filter) ||
             __put_user(len, &kfprog->len) ||
             __put_user(compat_ptr(ptr), &kfprog->filter))
+                return NULL;
+
+        return kfprog;
+}
+EXPORT_SYMBOL_GPL(get_compat_bpf_fprog);
+
+static int do_set_attach_filter(struct socket *sock, int level, int optname,
+                                char __user *optval, unsigned int optlen)
+{
+        struct sock_fprog __user *kfprog;
+
+        kfprog = get_compat_bpf_fprog(optval);
+        if (!kfprog)
                 return -EFAULT;
 
         return sock_setsockopt(sock, level, optname, (char __user *)kfprog,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 4040eb92d9c9..9bff6ef16fa7 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -93,6 +93,7 @@
 #include <net/inet_common.h>
 #endif
 #include <linux/bpf.h>
+#include <net/compat.h>
 
 #include "internal.h"
 
@@ -3940,6 +3941,27 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
 }
 
 
+#ifdef CONFIG_COMPAT
+static int compat_packet_setsockopt(struct socket *sock, int level, int optname,
+                                    char __user *optval, unsigned int optlen)
+{
+        struct packet_sock *po = pkt_sk(sock->sk);
+
+        if (level != SOL_PACKET)
+                return -ENOPROTOOPT;
+
+        if (optname == PACKET_FANOUT_DATA &&
+            po->fanout && po->fanout->type == PACKET_FANOUT_CBPF) {
+                optval = (char __user *)get_compat_bpf_fprog(optval);
+                if (!optval)
+                        return -EFAULT;
+                optlen = sizeof(struct sock_fprog);
+        }
+
+        return packet_setsockopt(sock, level, optname, optval, optlen);
+}
+#endif
+
 static int packet_notifier(struct notifier_block *this,
                            unsigned long msg, void *ptr)
 {
@@ -4416,6 +4438,9 @@ static const struct proto_ops packet_ops = {
         .shutdown =     sock_no_shutdown,
         .setsockopt =   packet_setsockopt,
         .getsockopt =   packet_getsockopt,
+#ifdef CONFIG_COMPAT
+        .compat_setsockopt = compat_packet_setsockopt,
+#endif
         .sendmsg =      packet_sendmsg,
         .recvmsg =      packet_recvmsg,
         .mmap =         packet_mmap,