This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map types. The lack of this protection can cause kernel crashes for value sizes that overflow int's. Such a crash was caught by syzkaller. The next patch adds more guard-rails at a lower level.
Unified · Split
| @@ -80,6 +80,18 @@ static int bloom_map_get_next_key(struct bpf_map *map, void *key, void *next_key · 79 unmodified lines | |||
| 80 | return -EOPNOTSUPP; | 80 | return -EOPNOTSUPP; |
| 81 | } | 81 | } |
| 82 | 82 | ||
| 83 | /* Called from syscall */ | ||
| 84 | static int bloom_map_alloc_check(union bpf_attr *attr) | ||
| 85 | { | ||
| 86 | if (attr->value_size > KMALLOC_MAX_SIZE) | ||
| 87 | /* if value_size is bigger, the user space won't be able to | ||
| 88 | * access the elements. | ||
| 89 | */ | ||
| 90 | return -E2BIG; | ||
| 91 | |||
| 92 | return 0; | ||
| 93 | } | ||
| 94 | |||
| 83 | static struct bpf_map *bloom_map_alloc(union bpf_attr *attr) | 95 | static struct bpf_map *bloom_map_alloc(union bpf_attr *attr) |
| 84 | { | 96 | { |
| 85 | u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits; | 97 | u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits; |
| @@ -191,6 +203,7 @@ static u64 bloom_map_mem_usage(const struct bpf_map *map) · 105 unmodified lines | |||
| 191 | BTF_ID_LIST_SINGLE(bpf_bloom_map_btf_ids, struct, bpf_bloom_filter) | 203 | BTF_ID_LIST_SINGLE(bpf_bloom_map_btf_ids, struct, bpf_bloom_filter) |
| 192 | const struct bpf_map_ops bloom_filter_map_ops = { | 204 | const struct bpf_map_ops bloom_filter_map_ops = { |
| 193 | .map_meta_equal = bpf_map_meta_equal, | 205 | .map_meta_equal = bpf_map_meta_equal, |
| 206 | .map_alloc_check = bloom_map_alloc_check, | ||
| 194 | .map_alloc = bloom_map_alloc, | 207 | .map_alloc = bloom_map_alloc, |
| 195 | .map_free = bloom_map_free, | 208 | .map_free = bloom_map_free, |
| 196 | .map_get_next_key = bloom_map_get_next_key, | 209 | .map_get_next_key = bloom_map_get_next_key, |
| @@ -2,6 +2,7 @@ · 1 unmodified line | |||
| 2 | /* Copyright (c) 2021 Facebook */ | 2 | /* Copyright (c) 2021 Facebook */ |
| 3 | 3 | ||
| 4 | #include <sys/syscall.h> | 4 | #include <sys/syscall.h> |
| 5 | #include <limits.h> | ||
| 5 | #include <test_progs.h> | 6 | #include <test_progs.h> |
| 6 | #include "bloom_filter_map.skel.h" | 7 | #include "bloom_filter_map.skel.h" |
| 7 | 8 | ||
| @@ -21,6 +22,11 @@ static void test_fail_cases(void) · 13 unmodified lines | |||
| 21 | if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid value size 0")) | 22 | if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid value size 0")) |
| 22 | close(fd); | 23 | close(fd); |
| 23 | 24 | ||
| 25 | /* Invalid value size: too big */ | ||
| 26 | fd = bpf_map_create(BPF_MAP_TYPE_BLOOM_FILTER, NULL, 0, INT32_MAX, 100, NULL); | ||
| 27 | if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid value too large")) | ||
| 28 | close(fd); | ||
| 29 | |||
| 24 | /* Invalid max entries size */ | 30 | /* Invalid max entries size */ |
| 25 | fd = bpf_map_create(BPF_MAP_TYPE_BLOOM_FILTER, NULL, 0, sizeof(value), 0, NULL); | 31 | fd = bpf_map_create(BPF_MAP_TYPE_BLOOM_FILTER, NULL, 0, sizeof(value), 0, NULL); |
| 26 | if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid max entries size")) | 32 | if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid max entries size")) |