1 files changed, 16 insertions, 0 deletions

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 9639334ebb7c..f70586b50838 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -140,6 +140,21 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
 }
 EXPORT_SYMBOL_GPL(tcp_twsk_unique);
 
+static int tcp_v4_pre_connect(struct sock *sk, struct sockaddr *uaddr,
+                              int addr_len)
+{
+        /* This check is replicated from tcp_v4_connect() and intended to
+         * prevent BPF program called below from accessing bytes that are out
+         * of the bound specified by user in addr_len.
+         */
+        if (addr_len < sizeof(struct sockaddr_in))
+                return -EINVAL;
+
+        sock_owned_by_me(sk);
+
+        return BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr);
+}
+
 /* This will initiate an outgoing connection. */
 int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
@@ -2408,6 +2423,7 @@ struct proto tcp_prot = {
         .name                   = "TCP",
         .owner                  = THIS_MODULE,
         .close                  = tcp_close,
+        .pre_connect            = tcp_v4_pre_connect,
         .connect                = tcp_v4_connect,
         .disconnect             = tcp_disconnect,
         .accept                 = inet_csk_accept,