netdev - [PATCH bpf-next] libbpf: fix crash in XDP socket part with new larger BPF_LOG_BUF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue,  9 Apr 2019 14:49:34 +0200
From:   Magnus Karlsson <magnus.karlsson@...el.com>
To:     magnus.karlsson@...el.com, bjorn.topel@...el.com, ast@...nel.org,
        daniel@...earbox.net, netdev@...r.kernel.org, bpf@...r.kernel.org
Subject: [PATCH bpf-next] libbpf: fix crash in XDP socket part with new larger BPF_LOG_BUF_SIZE

In commit da11b417583e ("libbpf: teach libbpf about log_level bit 2"),
the BPF_LOG_BUF_SIZE was increased to 16M. The XDP socket part of
libbpf allocated the log_buf on the stack, but for the new 16M buffer
size this is not going to work. Change the code to allocate the
log_buf using malloc instead. If the allocation fails, we go ahead and
load the program without a log buffer.

Signed-off-by: Magnus Karlsson <magnus.karlsson@...el.com>
---
 tools/lib/bpf/xsk.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c
index 8d0078b..412531b 100644
--- a/tools/lib/bpf/xsk.c
+++ b/tools/lib/bpf/xsk.c
@@ -259,7 +259,7 @@ int xsk_umem__create(struct xsk_umem **umem_ptr, void *umem_area, __u64 size,
 
 static int xsk_load_xdp_prog(struct xsk_socket *xsk)
 {
-	char bpf_log_buf[BPF_LOG_BUF_SIZE];
+	char *bpf_log_buf;
 	int err, prog_fd;
 
 	/* This is the C-program:
@@ -307,22 +307,27 @@ static int xsk_load_xdp_prog(struct xsk_socket *xsk)
 	};
 	size_t insns_cnt = sizeof(prog) / sizeof(struct bpf_insn);
 
+	bpf_log_buf = malloc(BPF_LOG_BUF_SIZE);
 	prog_fd = bpf_load_program(BPF_PROG_TYPE_XDP, prog, insns_cnt,
 				   "LGPL-2.1 or BSD-2-Clause", 0, bpf_log_buf,
-				   BPF_LOG_BUF_SIZE);
+				   bpf_log_buf ? BPF_LOG_BUF_SIZE : 0);
 	if (prog_fd < 0) {
-		pr_warning("BPF log buffer:\n%s", bpf_log_buf);
-		return prog_fd;
+		if (bpf_log_buf)
+			pr_warning("BPF log buffer:\n%s", bpf_log_buf);
+		err = prog_fd;
+		goto out;
 	}
 
 	err = bpf_set_link_xdp_fd(xsk->ifindex, prog_fd, xsk->config.xdp_flags);
 	if (err) {
 		close(prog_fd);
-		return err;
+		goto out;
 	}
 
 	xsk->prog_fd = prog_fd;
-	return 0;
+out:
+	free(bpf_log_buf);
+	return err;
 }
 
 static int xsk_get_max_queues(struct xsk_socket *xsk)
-- 
2.7.4