| From 61a8e4d1dadc13fcd008d176f87340d16445161e Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 30 Sep 2021 22:55:45 +0900 |
| Subject: bpf: Fix integer overflow in prealloc_elems_and_freelist() |
| |
| From: Tatsuhiko Yasumatsu <th.yasumatsu@gmail.com> |
| |
| [ Upstream commit 30e29a9a2bc6a4888335a6ede968b75cd329657a ] |
| |
| In prealloc_elems_and_freelist(), the multiplication to calculate the |
| size passed to bpf_map_area_alloc() could lead to an integer overflow. |
| As a result, out-of-bounds write could occur in pcpu_freelist_populate() |
| as reported by KASAN: |
| |
| [...] |
| [ 16.968613] BUG: KASAN: slab-out-of-bounds in pcpu_freelist_populate+0xd9/0x100 |
| [ 16.969408] Write of size 8 at addr ffff888104fc6ea0 by task crash/78 |
| [ 16.970038] |
| [ 16.970195] CPU: 0 PID: 78 Comm: crash Not tainted 5.15.0-rc2+ #1 |
| [ 16.970878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 |
| [ 16.972026] Call Trace: |
| [ 16.972306] dump_stack_lvl+0x34/0x44 |
| [ 16.972687] print_address_description.constprop.0+0x21/0x140 |
| [ 16.973297] ? pcpu_freelist_populate+0xd9/0x100 |
| [ 16.973777] ? pcpu_freelist_populate+0xd9/0x100 |
| [ 16.974257] kasan_report.cold+0x7f/0x11b |
| [ 16.974681] ? pcpu_freelist_populate+0xd9/0x100 |
| [ 16.975190] pcpu_freelist_populate+0xd9/0x100 |
| [ 16.975669] stack_map_alloc+0x209/0x2a0 |
| [ 16.976106] __sys_bpf+0xd83/0x2ce0 |
| [...] |
| |
| The possibility of this overflow was originally discussed in [0], but |
| was overlooked. |
| |
| Fix the integer overflow by changing elem_size to u64 from u32. |
| |
| [0] https://lore.kernel.org/bpf/728b238e-a481-eb50-98e9-b0f430ab01e7@gmail.com/ |
| |
| Fixes: 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation") |
| Signed-off-by: Tatsuhiko Yasumatsu <th.yasumatsu@gmail.com> |
| Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> |
| Link: https://lore.kernel.org/bpf/20210930135545.173698-1-th.yasumatsu@gmail.com |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| kernel/bpf/stackmap.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c |
| index a47d623f59fe..92310b07cb98 100644 |
| --- a/kernel/bpf/stackmap.c |
| +++ b/kernel/bpf/stackmap.c |
| @@ -63,7 +63,8 @@ static inline int stack_map_data_size(struct bpf_map *map) |
| |
| static int prealloc_elems_and_freelist(struct bpf_stack_map *smap) |
| { |
| - u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size; |
| + u64 elem_size = sizeof(struct stack_map_bucket) + |
| + (u64)smap->map.value_size; |
| int err; |
| |
| smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries, |
| -- |
| 2.33.0 |
| |