android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bpf: Prevent increasing bpf_jit_limit above max

Browse Source 
[ Upstream commit fadb7ff1a6c2c565af56b4aacdd086b067eed440 ]

Restrict bpf_jit_limit to the maximum supported by the arch's JIT.

Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211014142554.53120-4-lmb@cloudflare.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Lorenz Bauer 2021-10-14 15:25:53 +01:00 committed by Greg Kroah-Hartman
parent a3564fb7b0
commit b92ac0a9ca
3 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/filter.h
View File

@ -998,6 +998,7 @@ extern int bpf_jit_enable;
extern int bpf_jit_harden; extern int bpf_jit_harden;
extern int bpf_jit_kallsyms; extern int bpf_jit_kallsyms;
extern long bpf_jit_limit; extern long bpf_jit_limit;
extern long bpf_jit_limit_max;
typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size); typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);

4
kernel/bpf/core.c
View File

@ -528,6 +528,7 @@ int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON); int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
int bpf_jit_harden __read_mostly; int bpf_jit_harden __read_mostly;
long bpf_jit_limit __read_mostly; long bpf_jit_limit __read_mostly;
long bpf_jit_limit_max __read_mostly;
static void static void
bpf_prog_ksym_set_addr(struct bpf_prog *prog) bpf_prog_ksym_set_addr(struct bpf_prog *prog)
@ -821,7 +822,8 @@ u64 __weak bpf_jit_alloc_exec_limit(void)
static int __init bpf_jit_charge_init(void) static int __init bpf_jit_charge_init(void)
{ {
/* Only used as heuristic here to derive limit. */ /* Only used as heuristic here to derive limit. */
bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2, bpf_jit_limit_max = bpf_jit_alloc_exec_limit();
bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2,
PAGE_SIZE), LONG_MAX); PAGE_SIZE), LONG_MAX);
return 0; return 0;
} }

2
net/core/sysctl_net_core.c
View File

@ -419,7 +419,7 @@ static struct ctl_table net_core_table[] = {
.mode = 0600, .mode = 0600,
.proc_handler = proc_dolongvec_minmax_bpf_restricted, .proc_handler = proc_dolongvec_minmax_bpf_restricted,
.extra1 = &long_one, .extra1 = &long_one,
.extra2 = &long_max, .extra2 = &bpf_jit_limit_max,
}, },
#endif #endif
{ {