This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map types. The lack of this protection can cause kernel crashes for value sizes that overflow int's. Such a crash was caught by syzkaller. The next patch adds more guard-rails at a lower level.
Unified · Split
| @@ -80,6 +80,18 @@ static int bloom_map_get_next_key(struct bpf_map *map, void *key, void *next_key · 79 unmodified lines | ||
| 80 | 80 | return -EOPNOTSUPP; |
| 81 | 81 | } |
| 82 | 82 | |
| 83 | +/* Called from syscall */ | |
| 84 | +static int bloom_map_alloc_check(union bpf_attr *attr) | |
| 85 | +{ | |
| 86 | + if (attr->value_size > KMALLOC_MAX_SIZE) | |
| 87 | + /* if value_size is bigger, the user space won't be able to | |
| 88 | + * access the elements. | |
| 89 | + */ | |
| 90 | + return -E2BIG; | |
| 91 | + | |
| 92 | + return 0; | |
| 93 | +} | |
| 94 | + | |
| 83 | 95 | static struct bpf_map *bloom_map_alloc(union bpf_attr *attr) |
| 84 | 96 | { |
| 85 | 97 | u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits; |
| @@ -191,6 +203,7 @@ static u64 bloom_map_mem_usage(const struct bpf_map *map) · 105 unmodified lines | ||
| 191 | 203 | BTF_ID_LIST_SINGLE(bpf_bloom_map_btf_ids, struct, bpf_bloom_filter) |
| 192 | 204 | const struct bpf_map_ops bloom_filter_map_ops = { |
| 193 | 205 | .map_meta_equal = bpf_map_meta_equal, |
| 206 | + .map_alloc_check = bloom_map_alloc_check, | |
| 194 | 207 | .map_alloc = bloom_map_alloc, |
| 195 | 208 | .map_free = bloom_map_free, |
| 196 | 209 | .map_get_next_key = bloom_map_get_next_key, |
| @@ -2,6 +2,7 @@ · 1 unmodified line | ||
| 2 | 2 | /* Copyright (c) 2021 Facebook */ |
| 3 | 3 | |
| 4 | 4 | #include <sys/syscall.h> |
| 5 | +#include <limits.h> | |
| 5 | 6 | #include <test_progs.h> |
| 6 | 7 | #include "bloom_filter_map.skel.h" |
| 7 | 8 | |
| @@ -21,6 +22,11 @@ static void test_fail_cases(void) · 13 unmodified lines | ||
| 21 | 22 | if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid value size 0")) |
| 22 | 23 | close(fd); |
| 23 | 24 | |
| 25 | + /* Invalid value size: too big */ | |
| 26 | + fd = bpf_map_create(BPF_MAP_TYPE_BLOOM_FILTER, NULL, 0, INT32_MAX, 100, NULL); | |
| 27 | + if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid value too large")) | |
| 28 | + close(fd); | |
| 29 | + | |
| 24 | 30 | /* Invalid max entries size */ |
| 25 | 31 | fd = bpf_map_create(BPF_MAP_TYPE_BLOOM_FILTER, NULL, 0, sizeof(value), 0, NULL); |
| 26 | 32 | if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid max entries size")) |