Commit a4e02d6b authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'check-bloom-filter-map-value-size' 

Andrei Matei says:

====================
Check bloom filter map value size

v1->v2:
- prepend a patch addressing the bloom map specifically
- change low-level rejection error to EFAULT, to indicate a bug
====================

Link: https://lore.kernel.org/r/20240327024245.318299-1-andreimatei1@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents 96b98a65 ecc6a210

kernel/bpf/bloom_filter.c

+13 −0
Original line number Diff line number Diff line
@@ -80,6 +80,18 @@ static int bloom_map_get_next_key(struct bpf_map *map, void *key, void *next_key 
	return -EOPNOTSUPP;

}



/* Called from syscall */

static int bloom_map_alloc_check(union bpf_attr *attr)

{

	if (attr->value_size > KMALLOC_MAX_SIZE)

		/* if value_size is bigger, the user space won't be able to

		 * access the elements.

		 */

		return -E2BIG;



	return 0;

}



static struct bpf_map *bloom_map_alloc(union bpf_attr *attr)

{

	u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits;
@@ -191,6 +203,7 @@ static u64 bloom_map_mem_usage(const struct bpf_map *map) 
BTF_ID_LIST_SINGLE(bpf_bloom_map_btf_ids, struct, bpf_bloom_filter)

const struct bpf_map_ops bloom_filter_map_ops = {

	.map_meta_equal = bpf_map_meta_equal,

	.map_alloc_check = bloom_map_alloc_check,

	.map_alloc = bloom_map_alloc,

	.map_free = bloom_map_free,

	.map_get_next_key = bloom_map_get_next_key,

kernel/bpf/verifier.c

+5 −0
Original line number Diff line number Diff line
@@ -6701,6 +6701,11 @@ static int check_stack_access_within_bounds( 
	err = check_stack_slot_within_bounds(env, min_off, state, type);

	if (!err && max_off > 0)

		err = -EINVAL; /* out of stack access into non-negative offsets */

	if (!err && access_size < 0)

		/* access_size should not be negative (or overflow an int); others checks

		 * along the way should have prevented such an access.

		 */

		err = -EFAULT; /* invalid negative access size; integer overflow? */









	if (err) {









		if (tnum_is_const(reg->var_off)) {
































tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c



+6
−0






























Original line number
Diff line number
Diff line







@@ -2,6 +2,7 @@







/* Copyright (c) 2021 Facebook */



















#include <sys/syscall.h>









#include <limits.h>









#include <test_progs.h>









#include "bloom_filter_map.skel.h"


















@@ -21,6 +22,11 @@ static void test_fail_cases(void)







	if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid value size 0"))









		close(fd);



















	/* Invalid value size: too big */









	fd = bpf_map_create(BPF_MAP_TYPE_BLOOM_FILTER, NULL, 0, INT32_MAX, 100, NULL);









	if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid value too large"))









		close(fd);



















	/* Invalid max entries size */









	fd = bpf_map_create(BPF_MAP_TYPE_BLOOM_FILTER, NULL, 0, sizeof(value), 0, NULL);









	if (!ASSERT_LT(fd, 0, "bpf_map_create bloom filter invalid max entries size"))