Commit 9c481b90 authored Feb 14, 2018 by Daniel Borkmann Committed by Alexei Starovoitov Feb 14, 2018

bpf: fix bpf_prog_array_copy_to_user warning from perf event prog query

syzkaller tried to perform a prog query in perf_event_query_prog_array()
where struct perf_event_query_bpf had an ids_len of 1,073,741,353 and
thus causing a warning due to failed kcalloc() allocation out of the
bpf_prog_array_copy_to_user() helper. Given we cannot attach more than
64 programs to a perf event, there's no point in allowing huge ids_len.
Therefore, allow a buffer that would fix the maximum number of ids and
also add a __GFP_NOWARN to the temporary ids buffer.

Fixes: f371b304 ("bpf/tracing: allow user space to query prog array on the same tp")
Fixes: 0911287c ("bpf: fix bpf_prog_array_copy_to_user() issues")
Reported-by: <syzbot+cab5816b0edbabf598b3@syzkaller.appspotmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

parent 7fc17e90

kernel/bpf/core.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1590,7 +1590,7 @@ int bpf_prog_array_copy_to_user(struct bpf_prog_array __rcu *progs,
		* so always copy 'cnt' prog_ids to the user.
		* In a rare race the user will see zero prog_ids
		*/
		ids = kcalloc(cnt, sizeof(u32), GFP_USER);
		ids = kcalloc(cnt, sizeof(u32), GFP_USER \| __GFP_NOWARN);
		if (!ids)
		return -ENOMEM;
		rcu_read_lock();

kernel/trace/bpf_trace.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -872,6 +872,8 @@ int perf_event_query_prog_array(struct perf_event event, void __user info)
		return -EINVAL;
		if (copy_from_user(&query, uquery, sizeof(query)))
		return -EFAULT;
		if (query.ids_len > BPF_TRACE_MAX_PROGS)
		return -E2BIG;

		mutex_lock(&bpf_event_mutex);
		ret = bpf_prog_array_copy_info(event->tp_event->prog_array,

Admin message