devmap: Use bpf_map_area_alloc() for allocating hash buckets (99c51064) · Commits · 戴 / test

Syzkaller discovered that creating a hash of type devmap_hash with a large number of entries can hit the memory allocator limit for allocating contiguous memory regions. There's really no reason to use kmalloc_array() directly in the devmap code, so just switch it to the existing bpf_map_area_alloc() function that is used elsewhere. Fixes: ("xdp: Add devmap_hash map type for looking up devices by hashed index") Reported-by:

Xiumei Mu <xmu@redhat.com> Signed-off-by:

Toke Høiland-Jørgensen <toke@redhat.com> Signed-off-by:

Alexei Starovoitov <ast@kernel.org> Acked-by:

John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200616142829.114173-1-toke@redhat.com

kernel/bpf/devmap.c

+6 −4

Original line number	Diff line number	Diff line
		@@ -86,12 +86,13 @@ static DEFINE_PER_CPU(struct list_head, dev_flush_list);
		static DEFINE_SPINLOCK(dev_map_lock);
		static LIST_HEAD(dev_map_list);

		static struct hlist_head *dev_map_create_hash(unsigned int entries)
		static struct hlist_head *dev_map_create_hash(unsigned int entries,
		int numa_node)
		{
		int i;
		struct hlist_head *hash;

		hash = kmalloc_array(entries, sizeof(*hash), GFP_KERNEL);
		hash = bpf_map_area_alloc(entries * sizeof(*hash), numa_node);
		if (hash != NULL)
		for (i = 0; i < entries; i++)
		INIT_HLIST_HEAD(&hash[i]);
		@@ -145,7 +146,8 @@ static int dev_map_init_map(struct bpf_dtab dtab, union bpf_attr attr)
		return -EINVAL;

		if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
		dtab->dev_index_head = dev_map_create_hash(dtab->n_buckets);
		dtab->dev_index_head = dev_map_create_hash(dtab->n_buckets,
		dtab->map.numa_node);
		if (!dtab->dev_index_head)
		goto free_charge;

		@@ -232,7 +234,7 @@ static void dev_map_free(struct bpf_map *map)
		}
		}

		kfree(dtab->dev_index_head);
		bpf_map_area_free(dtab->dev_index_head);
		} else {
		for (i = 0; i < dtab->map.max_entries; i++) {
		struct bpf_dtab_netdev *dev;

Admin message