diff options
| author | Daniel Borkmann <daniel@iogearbox.net> | 2018-02-14 15:31:00 +0100 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2018-02-14 08:59:37 -0800 |
| commit | 9c481b908b011398b1491752271cd1e2c9ad5758 (patch) | |
| tree | 34373d78f0fab592edde75fec9631b43a56897ad /kernel/trace/bpf_trace.c | |
| parent | 7fc17e909edfb9bf421ee04e981d3d474175c7c7 (diff) | |
| download | linux-stable-9c481b908b011398b1491752271cd1e2c9ad5758.tar.gz linux-stable-9c481b908b011398b1491752271cd1e2c9ad5758.tar.bz2 linux-stable-9c481b908b011398b1491752271cd1e2c9ad5758.zip | |
bpf: fix bpf_prog_array_copy_to_user warning from perf event prog query
syzkaller tried to perform a prog query in perf_event_query_prog_array()
where struct perf_event_query_bpf had an ids_len of 1,073,741,353 and
thus causing a warning due to failed kcalloc() allocation out of the
bpf_prog_array_copy_to_user() helper. Given we cannot attach more than
64 programs to a perf event, there's no point in allowing huge ids_len.
Therefore, allow a buffer that would fix the maximum number of ids and
also add a __GFP_NOWARN to the temporary ids buffer.
Fixes: f371b304f12e ("bpf/tracing: allow user space to query prog array on the same tp")
Fixes: 0911287ce32b ("bpf: fix bpf_prog_array_copy_to_user() issues")
Reported-by: syzbot+cab5816b0edbabf598b3@syzkaller.appspotmail.com
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'kernel/trace/bpf_trace.c')
| -rw-r--r-- | kernel/trace/bpf_trace.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index fc2838ac8b78..c0a9e310d715 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -872,6 +872,8 @@ int perf_event_query_prog_array(struct perf_event *event, void __user *info) return -EINVAL; if (copy_from_user(&query, uquery, sizeof(query))) return -EFAULT; + if (query.ids_len > BPF_TRACE_MAX_PROGS) + return -E2BIG; mutex_lock(&bpf_event_mutex); ret = bpf_prog_array_copy_info(event->tp_event->prog_array, |