lkml.org 
[lkml]   [2021]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 033/323] bpf: Prevent increasing bpf_jit_limit above max
    Date
    From: Lorenz Bauer <lmb@cloudflare.com>

    [ Upstream commit fadb7ff1a6c2c565af56b4aacdd086b067eed440 ]

    Restrict bpf_jit_limit to the maximum supported by the arch's JIT.

    Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Link: https://lore.kernel.org/bpf/20211014142554.53120-4-lmb@cloudflare.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    include/linux/filter.h | 1 +
    kernel/bpf/core.c | 4 +++-
    net/core/sysctl_net_core.c | 2 +-
    3 files changed, 5 insertions(+), 2 deletions(-)

    diff --git a/include/linux/filter.h b/include/linux/filter.h
    index e981bd92a4e3a..89a6ef659b4ca 100644
    --- a/include/linux/filter.h
    +++ b/include/linux/filter.h
    @@ -877,6 +877,7 @@ extern int bpf_jit_enable;
    extern int bpf_jit_harden;
    extern int bpf_jit_kallsyms;
    extern long bpf_jit_limit;
    +extern long bpf_jit_limit_max;

    typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);

    diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
    index 341402bc1202d..4e5b5ae05406e 100644
    --- a/kernel/bpf/core.c
    +++ b/kernel/bpf/core.c
    @@ -372,6 +372,7 @@ int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON);
    int bpf_jit_harden __read_mostly;
    int bpf_jit_kallsyms __read_mostly;
    long bpf_jit_limit __read_mostly;
    +long bpf_jit_limit_max __read_mostly;

    static __always_inline void
    bpf_get_prog_addr_region(const struct bpf_prog *prog,
    @@ -598,7 +599,8 @@ u64 __weak bpf_jit_alloc_exec_limit(void)
    static int __init bpf_jit_charge_init(void)
    {
    /* Only used as heuristic here to derive limit. */
    - bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2,
    + bpf_jit_limit_max = bpf_jit_alloc_exec_limit();
    + bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2,
    PAGE_SIZE), LONG_MAX);
    return 0;
    }
    diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
    index 2597449ae9b48..0a0bf80623658 100644
    --- a/net/core/sysctl_net_core.c
    +++ b/net/core/sysctl_net_core.c
    @@ -417,7 +417,7 @@ static struct ctl_table net_core_table[] = {
    .mode = 0600,
    .proc_handler = proc_dolongvec_minmax_bpf_restricted,
    .extra1 = &long_one,
    - .extra2 = &long_max,
    + .extra2 = &bpf_jit_limit_max,
    },
    #endif
    {
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-24 13:53    [W:4.153 / U:0.132 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site