Commit d6d1e6c1 authored by Hou Tao's avatar Hou Tao Committed by Daniel Borkmann
Browse files

bpf: Limit the number of kprobes when attaching program to multiple kprobes 



An abnormally big cnt may also be assigned to kprobe_multi.cnt when
attaching multiple kprobes. It will trigger the following warning in
kvmalloc_node():

	if (unlikely(size > INT_MAX)) {
	    WARN_ON_ONCE(!(flags & __GFP_NOWARN));
	    return NULL;
	}

Fix the warning by limiting the maximal number of kprobes in
bpf_kprobe_multi_link_attach(). If the number of kprobes is greater than
MAX_KPROBE_MULTI_CNT, the attachment will fail and return -E2BIG.

Fixes: 0dcac272 ("bpf: Add multi kprobe link")
Signed-off-by: default avatarHou Tao <houtao1@huawei.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarJiri Olsa <jolsa@kernel.org>
Acked-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20231215100708.2265609-3-houtao@huaweicloud.com
parent 8b2efe51

kernel/trace/bpf_trace.c

+3 −0
Original line number Diff line number Diff line
@@ -43,6 +43,7 @@ 
	rcu_dereference_protected(p, lockdep_is_held(&bpf_event_mutex))



#define MAX_UPROBE_MULTI_CNT (1U << 20)

#define MAX_KPROBE_MULTI_CNT (1U << 20)



#ifdef CONFIG_MODULES

struct bpf_trace_module {
@@ -2972,6 +2973,8 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr 
	cnt = attr->link_create.kprobe_multi.cnt;

	if (!cnt)

		return -EINVAL;

	if (cnt > MAX_KPROBE_MULTI_CNT)

		return -E2BIG;



	size = cnt * sizeof(*addrs);

	addrs = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL);