bpf: Validate node_id in arena_alloc_pages()

arena_alloc_pages() accepts a plain int node_id and forwards it through the entire allocation chain without any bounds checking. Validate node_id before passing it down the allocation chain in arena_alloc_pages().

Puranjay Mohan committed 7 months ago

Commit 28459891 parent 380044c1 file · +4 −0Browse files

Unified · Split

kernel/bpf/arena.c+4−0

@@ -562,6 +562,10 @@ static long arena_alloc_pages(struct bpf_arena *arena, long uaddr, long page_cnt · 561 unmodified lines
562	562	u32 uaddr32;
563	563	int ret, i;
564	564
	565	+ if (node_id != NUMA_NO_NODE &&
	566	+ ((unsigned int)node_id >= nr_node_ids \|\| !node_online(node_id)))
	567	+ return 0;
	568	+
565	569	if (page_cnt > page_cnt_max)
566	570	return 0;
567	571