bpf: Validate node_id in arena_alloc_pages()

arena_alloc_pages() accepts a plain int node_id and forwards it through the entire allocation chain without any bounds checking. Validate node_id before passing it down the allocation chain in arena_alloc_pages().

Puranjay Mohan committed 7 months ago

Commit 28459891 parent 380044c1 file · +4 −0Browse files

Showing the changes to kernel (1 of 1 file). Show all

Unified · Split

kernel/bpf/arena.c+4−0

@@ -562,6 +562,10 @@ static long arena_alloc_pages(struct bpf_arena *arena, long uaddr, long page_cnt · 561 unmodified lines
562	u32 uaddr32;	562	u32 uaddr32;
563	int ret, i;	563	int ret, i;
564		564
		565	if (node_id != NUMA_NO_NODE &&
		566	((unsigned int)node_id >= nr_node_ids \|\| !node_online(node_id)))
		567	return 0;
		568
565	if (page_cnt > page_cnt_max)	569	if (page_cnt > page_cnt_max)
566	return 0;	570	return 0;
567		571