tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

bpf: Limit the number of uprobes when attaching program to multiple uprobes

An abnormally big cnt may be passed to link_create.uprobe_multi.cnt,
and it will trigger the following warning in kvmalloc_node():

if (unlikely(size > INT_MAX)) {
WARN_ON_ONCE(!(flags & __GFP_NOWARN));
return NULL;
}

Fix the warning by limiting the maximal number of uprobes in
bpf_uprobe_multi_link_attach(). If the number of uprobes is greater than
MAX_UPROBE_MULTI_CNT, the attachment will return -E2BIG.

Fixes: 89ae89f53d20 ("bpf: Add multi uprobe link")
Reported-by: Xingwei Lee <xrivendell7@gmail.com>
Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Closes: https://lore.kernel.org/bpf/CABOYnLwwJY=yFAGie59LFsUsBAgHfroVqbzZ5edAXbFE3YiNVA@mail.gmail.com
Link: https://lore.kernel.org/bpf/20231215100708.2265609-2-houtao@huaweicloud.com

authored by

Hou Tao and committed by
Daniel Borkmann 8b2efe51 7489723c

+4
+4
kernel/trace/bpf_trace.c
··· 42 42 #define bpf_event_rcu_dereference(p) \ 43 43 rcu_dereference_protected(p, lockdep_is_held(&bpf_event_mutex)) 44 44 45 + #define MAX_UPROBE_MULTI_CNT (1U << 20) 46 + 45 47 #ifdef CONFIG_MODULES 46 48 struct bpf_trace_module { 47 49 struct module *module; ··· 3346 3344 3347 3345 if (!upath || !uoffsets || !cnt) 3348 3346 return -EINVAL; 3347 + if (cnt > MAX_UPROBE_MULTI_CNT) 3348 + return -E2BIG; 3349 3349 3350 3350 uref_ctr_offsets = u64_to_user_ptr(attr->link_create.uprobe_multi.ref_ctr_offsets); 3351 3351 ucookies = u64_to_user_ptr(attr->link_create.uprobe_multi.cookies);