This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map types. The lack of this protection can cause kernel crashes for value sizes that overflow int's. Such a crash was caught by syzkaller. The next patch adds more guard-rails at a lower level.
Showing the changes to kernel (1 of 2 files). Show all
Unified · Split
| @@ -80,6 +80,18 @@ static int bloom_map_get_next_key(struct bpf_map *map, void *key, void *next_key · 79 unmodified lines | |||
| 80 | return -EOPNOTSUPP; | 80 | return -EOPNOTSUPP; |
| 81 | } | 81 | } |
| 82 | 82 | ||
| 83 | /* Called from syscall */ | ||
| 84 | static int bloom_map_alloc_check(union bpf_attr *attr) | ||
| 85 | { | ||
| 86 | if (attr->value_size > KMALLOC_MAX_SIZE) | ||
| 87 | /* if value_size is bigger, the user space won't be able to | ||
| 88 | * access the elements. | ||
| 89 | */ | ||
| 90 | return -E2BIG; | ||
| 91 | |||
| 92 | return 0; | ||
| 93 | } | ||
| 94 | |||
| 83 | static struct bpf_map *bloom_map_alloc(union bpf_attr *attr) | 95 | static struct bpf_map *bloom_map_alloc(union bpf_attr *attr) |
| 84 | { | 96 | { |
| 85 | u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits; | 97 | u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits; |
| @@ -191,6 +203,7 @@ static u64 bloom_map_mem_usage(const struct bpf_map *map) · 105 unmodified lines | |||
| 191 | BTF_ID_LIST_SINGLE(bpf_bloom_map_btf_ids, struct, bpf_bloom_filter) | 203 | BTF_ID_LIST_SINGLE(bpf_bloom_map_btf_ids, struct, bpf_bloom_filter) |
| 192 | const struct bpf_map_ops bloom_filter_map_ops = { | 204 | const struct bpf_map_ops bloom_filter_map_ops = { |
| 193 | .map_meta_equal = bpf_map_meta_equal, | 205 | .map_meta_equal = bpf_map_meta_equal, |
| 206 | .map_alloc_check = bloom_map_alloc_check, | ||
| 194 | .map_alloc = bloom_map_alloc, | 207 | .map_alloc = bloom_map_alloc, |
| 195 | .map_free = bloom_map_free, | 208 | .map_free = bloom_map_free, |
| 196 | .map_get_next_key = bloom_map_get_next_key, | 209 | .map_get_next_key = bloom_map_get_next_key, |