linux-kernel - Re: [PATCH net 0/3] Fix for BPF devmap percpu allocation splat

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <59E61D8F.5000505@iogearbox.net>
Date:   Tue, 17 Oct 2017 17:11:11 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     David Laight <David.Laight@...LAB.COM>,
        "davem@...emloft.net" <davem@...emloft.net>
CC:     "tj@...nel.org" <tj@...nel.org>, "ast@...nel.org" <ast@...nel.org>,
        "john.fastabend@...il.com" <john.fastabend@...il.com>,
        "mark.rutland@....com" <mark.rutland@....com>,
        "richard@....at" <richard@....at>,
        "sp3485@...umbia.edu" <sp3485@...umbia.edu>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH net 0/3] Fix for BPF devmap percpu allocation splat

On 10/17/2017 05:03 PM, David Laight wrote:
> From: Daniel Borkmann
>> Sent: 17 October 2017 15:56
>>
>> The set fixes a splat in devmap percpu allocation when we alloc
>> the flush bitmap. Patch 1 is a prerequisite for the fix in patch 2,
>> patch 1 is rather small, so if this could be routed via -net, for
>> example, with Tejun's Ack that would be good. Patch 3 gets rid of
>> remaining PCPU_MIN_UNIT_SIZE checks, which are percpu allocator
>> internals and should not be used.
>
> Does it make sense to allow the user program to try to allocate ever
> smaller very large maps until it finds one that succeeds - thus
> using up all the percpu space?
>
> Or is this a 'root only' 'shoot self in foot' job?

It's root only although John still has a pending fix to be flushed
out for -net first in the next days to actually enforce that cap
(devmap is not in an official kernel yet at this point, so all good),
but apart from this, all map allocs in general are accounted for
as well.

Thanks,
Daniel