Commit 8b2efe51 authored by Hou Tao's avatar Hou Tao Committed by Daniel Borkmann
Browse files

bpf: Limit the number of uprobes when attaching program to multiple uprobes 



An abnormally big cnt may be passed to link_create.uprobe_multi.cnt,
and it will trigger the following warning in kvmalloc_node():

	if (unlikely(size > INT_MAX)) {
		WARN_ON_ONCE(!(flags & __GFP_NOWARN));
		return NULL;
	}

Fix the warning by limiting the maximal number of uprobes in
bpf_uprobe_multi_link_attach(). If the number of uprobes is greater than
MAX_UPROBE_MULTI_CNT, the attachment will return -E2BIG.

Fixes: 89ae89f5 ("bpf: Add multi uprobe link")
Reported-by: default avatarXingwei Lee <xrivendell7@gmail.com>
Signed-off-by: default avatarHou Tao <houtao1@huawei.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarJiri Olsa <jolsa@kernel.org>
Acked-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Closes: https://lore.kernel.org/bpf/CABOYnLwwJY=yFAGie59LFsUsBAgHfroVqbzZ5edAXbFE3YiNVA@mail.gmail.com
Link: https://lore.kernel.org/bpf/20231215100708.2265609-2-houtao@huaweicloud.com
parent 7489723c

kernel/trace/bpf_trace.c

+4 −0
Original line number Diff line number Diff line
@@ -42,6 +42,8 @@ 
#define bpf_event_rcu_dereference(p)					\

	rcu_dereference_protected(p, lockdep_is_held(&bpf_event_mutex))



#define MAX_UPROBE_MULTI_CNT (1U << 20)



#ifdef CONFIG_MODULES

struct bpf_trace_module {

	struct module *module;
@@ -3344,6 +3346,8 @@ int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr 


	if (!upath || !uoffsets || !cnt)

		return -EINVAL;

	if (cnt > MAX_UPROBE_MULTI_CNT)

		return -E2BIG;



	uref_ctr_offsets = u64_to_user_ptr(attr->link_create.uprobe_multi.ref_ctr_offsets);

	ucookies = u64_to_user_ptr(attr->link_create.uprobe_multi.cookies);