bpf: Validate node_id in arena_alloc_pages()

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

arena_alloc_pages() accepts a plain int node_id and forwards it through
the entire allocation chain without any bounds checking.

Validate node_id before passing it down the allocation chain in
arena_alloc_pages().

Fixes: 317460317a02 ("bpf: Introduce bpf_arena.")
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/r/20260417152135.1383754-1-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

authored by

Puranjay Mohan and committed by

Alexei Starovoitov 3 weeks ago 2845989f 380044c4

1 changed file

expand all

kernel

bpf

arena.c

kernel/bpf/arena.c

··· 562 562 u32 uaddr32; 563 563 int ret, i; 564 564 565 + if (node_id != NUMA_NO_NODE && 566 + ((unsigned int)node_id >= nr_node_ids || !node_online(node_id))) 567 + return 0; 568 + 565 569 if (page_cnt > page_cnt_max) 566 570 return 0; 567 571

Configure Feed

Configure Feed