]> git.baikalelectronics.ru Git - kernel.git/commit
bpf: fix refcnt overflow
authorAlexei Starovoitov <ast@fb.com>
Thu, 28 Apr 2016 01:56:20 +0000 (18:56 -0700)
committerDavid S. Miller <davem@davemloft.net>
Thu, 28 Apr 2016 21:29:45 +0000 (17:29 -0400)
commit98d98afd11ec809c7f3f11835abbec21d58635d1
treed0db595b54f82b59049d4b879561c2f97d25e18b
parent734dfe634b01168c47738b9eb481cb61e224bebf
bpf: fix refcnt overflow

On a system with >32Gbyte of phyiscal memory and infinite RLIMIT_MEMLOCK,
the malicious application may overflow 32-bit bpf program refcnt.
It's also possible to overflow map refcnt on 1Tb system.
Impose 32k hard limit which means that the same bpf program or
map cannot be shared by more than 32k processes.

Fixes: d361bd865ac6 ("bpf: enable non-root eBPF programs")
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/bpf.h
kernel/bpf/inode.c
kernel/bpf/syscall.c
kernel/bpf/verifier.c