Daniel Borkmann bbeb6e4323 bpf, array: fix overflow in max_entries and undefined behavior in index_mask ... syzkaller tried to alloc a map with 0xfffffffd entries out of a userns, and thus unprivileged. With the recently added logic in b2157399cc ("bpf: prevent out-of-bounds speculation") we round this up to the next power of two value for max_entries for unprivileged such that we can apply proper masking into potentially zeroed out map slots. However, this will generate an index_mask of 0xffffffff, and therefore a + 1 will let this overflow into new max_entries of 0. This will pass allocation, etc, and later on map access we still enforce on the original attr->max_entries value which was 0xfffffffd, therefore triggering GPF all over the place. Thus bail out on overflow in such case. Moreover, on 32 bit archs roundup_pow_of_two() can also not be used, since fls_long(max_entries - 1) can result in 32 and 1UL << 32 in 32 bit space is undefined. Therefore, do this by hand in a 64 bit variable. This fixes all the issues triggered by syzkaller's reproducers. Fixes: b2157399cc ("bpf: prevent out-of-bounds speculation") Reported-by: syzbot+b0efb8e572d01bce1ae0@syzkaller.appspotmail.com Reported-by: syzbot+6c15e9744f75f2364773@syzkaller.appspotmail.com Reported-by: syzbot+d2f5524fb46fd3b312ee@syzkaller.appspotmail.com Reported-by: syzbot+61d23c95395cc90dbc2b@syzkaller.appspotmail.com Reported-by: syzbot+0d363c942452cca68c01@syzkaller.appspotmail.com Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Alexei Starovoitov <ast@kernel.org>		2018-01-10 14:46:39 -08:00
..
Makefile	…
arraymap.c	bpf, array: fix overflow in max_entries and undefined behavior in index_mask	2018-01-10 14:46:39 -08:00
bpf_lru_list.c	…
bpf_lru_list.h	…
cgroup.c	…
core.c	bpf: introduce BPF_JIT_ALWAYS_ON config	2018-01-09 22:25:26 +01:00
cpumap.c	…
devmap.c	…
disasm.c	…
disasm.h	…
hashtab.c	bpf: add schedule points to map alloc/free	2017-12-12 15:27:22 -08:00
helpers.c	…
inode.c	fix "netfilter: xt_bpf: Fix XT_BPF_MODE_FD_PINNED mode of 'xt_bpf_info_v1'"	2018-01-05 11:43:39 -05:00
lpm_trie.c	…
map_in_map.c	…
map_in_map.h	…
offload.c	bpf: offload: add a license header	2017-11-27 22:24:51 +01:00
percpu_freelist.c	…
percpu_freelist.h	…
sockmap.c	bpf: sockmap missing NULL psock check	2018-01-07 00:01:46 +01:00
stackmap.c	…
syscall.c	fix "netfilter: xt_bpf: Fix XT_BPF_MODE_FD_PINNED mode of 'xt_bpf_info_v1'"	2018-01-05 11:43:39 -05:00
tnum.c	…
verifier.c	bpf: arsh is not supported in 32 bit alu thus reject it	2018-01-10 14:42:22 -08:00