]> git.baikalelectronics.ru Git - kernel.git/commit
bpf: fix bpf_prog_array_copy_to_user warning from perf event prog query
authorDaniel Borkmann <daniel@iogearbox.net>
Wed, 14 Feb 2018 14:31:00 +0000 (15:31 +0100)
committerAlexei Starovoitov <ast@kernel.org>
Wed, 14 Feb 2018 16:59:37 +0000 (08:59 -0800)
commitdc4a0de238ecb08dfa8908762cd5aa0f8822b346
tree34373d78f0fab592edde75fec9631b43a56897ad
parent96cca7f98322409e56c87f0bfc0ebef86345accd
bpf: fix bpf_prog_array_copy_to_user warning from perf event prog query

syzkaller tried to perform a prog query in perf_event_query_prog_array()
where struct perf_event_query_bpf had an ids_len of 1,073,741,353 and
thus causing a warning due to failed kcalloc() allocation out of the
bpf_prog_array_copy_to_user() helper. Given we cannot attach more than
64 programs to a perf event, there's no point in allowing huge ids_len.
Therefore, allow a buffer that would fix the maximum number of ids and
also add a __GFP_NOWARN to the temporary ids buffer.

Fixes: 843b77e6584f ("bpf/tracing: allow user space to query prog array on the same tp")
Fixes: 725c3fa8b432 ("bpf: fix bpf_prog_array_copy_to_user() issues")
Reported-by: syzbot+cab5816b0edbabf598b3@syzkaller.appspotmail.com
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/core.c
kernel/trace/bpf_trace.c