Maciej Fijalkowski ab244dd7cf bpf: fix OOB devmap writes when deleting elements ... Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, causes the OOB writes. Fix is simple as changing the type from int to u32, however, when compared to XSKMAP case, one more thing needs to be addressed. When map is released from system via dev_map_free(), we iterate through all of the entries and an iterator variable is also an int, which implies OOB accesses. Again, change it to be u32. Example splat below: [ 160.724676] BUG: unable to handle page fault for address: ffffc8fc2c001000 [ 160.731662] #PF: supervisor read access in kernel mode [ 160.736876] #PF: error_code(0x0000) - not-present page [ 160.742095] PGD 0 P4D 0 [ 160.744678] Oops: Oops: 0000 [#1] PREEMPT SMP [ 160.749106] CPU: 1 UID: 0 PID: 520 Comm: kworker/u145:12 Not tainted 6.12.0-rc1+ #487 [ 160.757050] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 160.767642] Workqueue: events_unbound bpf_map_free_deferred [ 160.773308] RIP: 0010:dev_map_free+0x77/0x170 [ 160.777735] Code: 00 e8 fd 91 ed ff e8 b8 73 ed ff 41 83 7d 18 19 74 6e 41 8b 45 24 49 8b bd f8 00 00 00 31 db 85 c0 74 48 48 63 c3 48 8d 04 c7 <48> 8b 28 48 85 ed 74 30 48 8b 7d 18 48 85 ff 74 05 e8 b3 52 fa ff [ 160.796777] RSP: 0018:ffffc9000ee1fe38 EFLAGS: 00010202 [ 160.802086] RAX: ffffc8fc2c001000 RBX: 0000000080000000 RCX: 0000000000000024 [ 160.809331] RDX: 0000000000000000 RSI: 0000000000000024 RDI: ffffc9002c001000 [ 160.816576] RBP: 0000000000000000 R08: 0000000000000023 R09: 0000000000000001 [ 160.823823] R10: 0000000000000001 R11: 00000000000ee6b2 R12: dead000000000122 [ 160.831066] R13: ffff88810c928e00 R14: ffff8881002df405 R15: 0000000000000000 [ 160.838310] FS: 0000000000000000(0000) GS:ffff8897e0c40000(0000) knlGS:0000000000000000 [ 160.846528] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 160.852357] CR2: ffffc8fc2c001000 CR3: 0000000005c32006 CR4: 00000000007726f0 [ 160.859604] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 160.866847] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 160.874092] PKRU: 55555554 [ 160.876847] Call Trace: [ 160.879338] <TASK> [ 160.881477] ? __die+0x20/0x60 [ 160.884586] ? page_fault_oops+0x15a/0x450 [ 160.888746] ? search_extable+0x22/0x30 [ 160.892647] ? search_bpf_extables+0x5f/0x80 [ 160.896988] ? exc_page_fault+0xa9/0x140 [ 160.900973] ? asm_exc_page_fault+0x22/0x30 [ 160.905232] ? dev_map_free+0x77/0x170 [ 160.909043] ? dev_map_free+0x58/0x170 [ 160.912857] bpf_map_free_deferred+0x51/0x90 [ 160.917196] process_one_work+0x142/0x370 [ 160.921272] worker_thread+0x29e/0x3b0 [ 160.925082] ? rescuer_thread+0x4b0/0x4b0 [ 160.929157] kthread+0xd4/0x110 [ 160.932355] ? kthread_park+0x80/0x80 [ 160.936079] ret_from_fork+0x2d/0x50 [ 160.943396] ? kthread_park+0x80/0x80 [ 160.950803] ret_from_fork_asm+0x11/0x20 [ 160.958482] </TASK> Fixes: 546ac1ffb7 ("bpf: add devmap, a map for storing net device references") CC: stable@vger.kernel.org Reported-by: Jordy Zomer <jordyzomer@google.com> Suggested-by: Jordy Zomer <jordyzomer@google.com> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Link: https://lore.kernel.org/r/20241122121030.716788-3-maciej.fijalkowski@intel.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>		2024-11-25 14:25:48 -08:00
..
preload	bpf: make preloaded map iterators to display map elements count	2023-07-06 12:42:25 -07:00
arena.c	bpf: Do not alloc arena on unsupported arches	2024-11-15 08:10:13 -08:00
arraymap.c	bpf: Prevent tailcall infinite loop caused by freplace	2024-10-16 09:21:18 -07:00
bloom_filter.c	bpf: Check bloom filter map value size	2024-03-27 09:56:17 -07:00
bpf_cgrp_storage.c	bpf: Add "bool swap_uptrs" arg to bpf_local_storage_update() and bpf_selem_alloc()	2024-10-24 10:25:59 -07:00
bpf_inode_storage.c	bpf-next-bpf-next-6.13	2024-11-21 08:11:04 -08:00
bpf_iter.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
bpf_local_storage.c	bpf: Add uptr support in the map_value of the task local storage.	2024-10-24 10:25:59 -07:00
bpf_lru_list.c	bpf: Address KCSAN report on bpf_lru_list	2023-05-12 12:01:03 -07:00
bpf_lru_list.h	bpf: lru: Remove unused declaration bpf_lru_promote()	2023-08-08 17:21:42 -07:00
bpf_lsm.c	bpf, lsm: Remove getlsmprop hooks BTF IDs	2024-11-25 14:14:17 -08:00
bpf_struct_ops.c	bpf: Add kernel symbol for struct_ops trampoline	2024-11-12 17:13:46 -08:00
bpf_task_storage.c	bpf-next-bpf-next-6.13	2024-11-21 08:11:04 -08:00
btf_iter.c	bpf: Remove custom build rule	2024-08-30 08:55:26 -07:00
btf_relocate.c	bpf: Remove custom build rule	2024-08-30 08:55:26 -07:00
btf.c	bpf: Mark raw_tp arguments with PTR_MAYBE_NULL	2024-11-04 11:37:36 -08:00
cgroup_iter.c	bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg	2023-11-07 15:24:25 -08:00
cgroup.c	Summary	2024-11-22 20:36:11 -08:00
core.c	bpf-next-bpf-next-6.13	2024-11-21 08:11:04 -08:00
cpumap.c	bpf, cpumap: Move xdp:xdp_cpumap_kthread tracepoint before rcv	2024-09-11 16:32:11 +02:00
cpumask.c	bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs	2024-04-05 10:56:09 -07:00
crypto.c	bpf: crypto: make state and IV dynptr nullable	2024-06-13 16:33:04 -07:00
devmap.c	bpf: fix OOB devmap writes when deleting elements	2024-11-25 14:25:48 -08:00
disasm.c	bpf: add special internal-only MOV instruction to resolve per-CPU addrs	2024-04-03 10:29:55 -07:00
disasm.h	bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause	2021-09-02 14:49:23 +02:00
dispatcher.c	bpf: Add kernel symbol for struct_ops trampoline	2024-11-12 17:13:46 -08:00
hashtab.c	bpf: Call free_htab_elem() after htab_unlock_bucket()	2024-11-11 08:18:30 -08:00
helpers.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf	2024-11-13 12:52:51 -08:00
inode.c	bpf: Preserve param->string when parsing mount options	2024-10-22 12:56:38 -07:00
Kconfig	bpf: remove CONFIG_BPF_JIT dependency on CONFIG_MODULES of	2024-05-14 00:36:29 -07:00
kmem_cache_iter.c	bpf: Add open coded version of kmem_cache iterator	2024-11-01 11:08:32 -07:00
link_iter.c	bpf: Add bpf_link iterator	2022-05-10 11:20:45 -07:00
local_storage.c	bpf: Replace 8 seq_puts() calls by seq_putc() calls	2024-07-29 12:53:00 -07:00
log.c	bpf: Fix print_reg_state's constant scalar dump	2024-10-17 11:06:34 -07:00
lpm_trie.c	bpf: Fix out-of-bounds write in trie_get_next_key()	2024-10-29 13:41:40 -07:00
Makefile	bpf: Introduce range_tree data structure and use it in bpf arena	2024-11-13 13:52:45 -08:00
map_in_map.c	bpf: switch maps to CLASS(fd, ...)	2024-08-13 15:58:17 -07:00
map_in_map.h	bpf: Add map and need_defer parameters to .map_fd_put_ptr()	2023-12-04 17:50:26 -08:00
map_iter.c	bpf: treewide: Annotate BPF kfuncs in BTF	2024-01-31 20:40:56 -08:00
memalloc.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf	2024-11-13 12:52:51 -08:00
mmap_unlock_work.h	bpf: Introduce helper bpf_find_vma	2021-11-07 11:54:51 -08:00
mprog.c	bpf: Handle bpf_mprog_query with NULL entry	2023-10-06 17:11:20 -07:00
net_namespace.c	net: Add includes masked by netdevice.h including uapi/bpf.h	2021-12-29 20:03:05 -08:00
offload.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-09-21 21:49:45 +02:00
percpu_freelist.c	bpf: Initialize same number of free nodes for each pcpu_freelist	2022-11-11 12:05:14 -08:00
percpu_freelist.h	bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI	2020-10-06 00:04:11 +02:00
prog_iter.c	bpf: Refactor bpf_iter_reg to have separate seq_info member	2020-07-25 20:16:32 -07:00
queue_stack_maps.c	bpf: Avoid deadlock when using queue and stack maps from NMI	2023-09-11 19:04:49 -07:00
range_tree.c	bpf: Add necessary migrate_disable to range_tree.	2024-11-15 08:11:53 -08:00
range_tree.h	bpf: Introduce range_tree data structure and use it in bpf arena	2024-11-13 13:52:45 -08:00
relo_core.c	bpf: Remove custom build rule	2024-08-30 08:55:26 -07:00
reuseport_array.c	bpf: Use sockfd_put() helper	2024-08-30 08:57:47 -07:00
ringbuf.c	bpf: Add MEM_WRITE attribute	2024-10-22 15:42:56 -07:00
stackmap.c	bpf: wire up sleepable bpf_get_stack() and bpf_get_task_stack() helpers	2024-09-11 09:58:31 -07:00
syscall.c	tracing updates for v6.13:	2024-11-22 13:27:01 -08:00
sysfs_btf.c	btf: Avoid weak external references	2024-04-16 16:35:13 +02:00
task_iter.c	vfs-6.13.file	2024-11-18 10:30:29 -08:00
tcx.c	bpf, tcx: Get rid of tcx_link_const	2023-10-23 15:01:53 -07:00
tnum.c	bpf: simplify tnum output if a fully known constant	2023-12-02 11:36:51 -08:00
token.c	remove pointless includes of <linux/fdtable.h>	2024-10-07 13:34:41 -04:00
trampoline.c	bpf: Add kernel symbol for struct_ops trampoline	2024-11-12 17:13:46 -08:00
verifier.c	bpf: use common instruction history across all states	2024-11-15 10:20:47 -08:00