This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map types. The lack of this protection can cause kernel crashes for value sizes that overflow int's. Such a crash was caught by syzkaller. The next patch adds more guard-rails at a lower level.
Showing the changes to kernel (1 of 2 files). Show all
Unified · Split
| @@ -80,6 +80,18 @@ static int bloom_map_get_next_key(struct bpf_map *map, void *key, void *next_key · 79 unmodified lines | ||
| 80 | 80 | return -EOPNOTSUPP; |
| 81 | 81 | } |
| 82 | 82 | |
| 83 | +/* Called from syscall */ | |
| 84 | +static int bloom_map_alloc_check(union bpf_attr *attr) | |
| 85 | +{ | |
| 86 | + if (attr->value_size > KMALLOC_MAX_SIZE) | |
| 87 | + /* if value_size is bigger, the user space won't be able to | |
| 88 | + * access the elements. | |
| 89 | + */ | |
| 90 | + return -E2BIG; | |
| 91 | + | |
| 92 | + return 0; | |
| 93 | +} | |
| 94 | + | |
| 83 | 95 | static struct bpf_map *bloom_map_alloc(union bpf_attr *attr) |
| 84 | 96 | { |
| 85 | 97 | u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits; |
| @@ -191,6 +203,7 @@ static u64 bloom_map_mem_usage(const struct bpf_map *map) · 105 unmodified lines | ||
| 191 | 203 | BTF_ID_LIST_SINGLE(bpf_bloom_map_btf_ids, struct, bpf_bloom_filter) |
| 192 | 204 | const struct bpf_map_ops bloom_filter_map_ops = { |
| 193 | 205 | .map_meta_equal = bpf_map_meta_equal, |
| 206 | + .map_alloc_check = bloom_map_alloc_check, | |
| 194 | 207 | .map_alloc = bloom_map_alloc, |
| 195 | 208 | .map_free = bloom_map_free, |
| 196 | 209 | .map_get_next_key = bloom_map_get_next_key, |