lkml.org 
[lkml]   [2022]   [May]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH bpf-next v3 1/4] bpf_trace: check size for overflow in bpf_kprobe_multi_link_attach
    On Tue, May 17, 2022 at 09:36:15AM +0200, Eugene Syromiatnikov wrote:
    > Check that size would not overflow before calculation (and return
    > -EOVERFLOW if it will), to prevent potential out-of-bounds write
    > with the following copy_from_user. Use kvmalloc_array
    > in copy_user_syms to prevent out-of-bounds write into syms
    > (and especially buf) as well.
    >
    > Fixes: 0dcac272540613d4 ("bpf: Add multi kprobe link")
    > Cc: <stable@vger.kernel.org> # 5.18
    > Signed-off-by: Eugene Syromiatnikov <esyr@redhat.com>

    Acked-by: Jiri Olsa <jolsa@kernel.org>

    thanks,
    jirka

    > ---
    > kernel/trace/bpf_trace.c | 7 ++++---
    > 1 file changed, 4 insertions(+), 3 deletions(-)
    >
    > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
    > index 7141ca8..9c041be 100644
    > --- a/kernel/trace/bpf_trace.c
    > +++ b/kernel/trace/bpf_trace.c
    > @@ -2261,11 +2261,11 @@ static int copy_user_syms(struct user_syms *us, unsigned long __user *usyms, u32
    > int err = -ENOMEM;
    > unsigned int i;
    >
    > - syms = kvmalloc(cnt * sizeof(*syms), GFP_KERNEL);
    > + syms = kvmalloc_array(cnt, sizeof(*syms), GFP_KERNEL);
    > if (!syms)
    > goto error;
    >
    > - buf = kvmalloc(cnt * KSYM_NAME_LEN, GFP_KERNEL);
    > + buf = kvmalloc_array(cnt, KSYM_NAME_LEN, GFP_KERNEL);
    > if (!buf)
    > goto error;
    >
    > @@ -2461,7 +2461,8 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
    > if (!cnt)
    > return -EINVAL;
    >
    > - size = cnt * sizeof(*addrs);
    > + if (check_mul_overflow(cnt, (u32)sizeof(*addrs), &size))
    > + return -EOVERFLOW;
    > addrs = kvmalloc(size, GFP_KERNEL);
    > if (!addrs)
    > return -ENOMEM;
    > --
    > 2.1.4
    >

    \
     
     \ /
      Last update: 2022-05-17 11:14    [W:2.191 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site