netdev - Re: [PATCH bpf-next] bpf: use kvmalloc in map_lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4Bzb5A06ZP5k4uDwspBp7KfzY8n3=D7kr9K=6Xbf9cj4-Tw@mail.gmail.com>
Date:   Mon, 16 Aug 2021 15:32:54 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Daniel Borkmann <daniel@...earbox.net>
Cc:     Stanislav Fomichev <sdf@...gle.com>,
        Networking <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Andrii Nakryiko <andrii@...nel.org>
Subject: Re: [PATCH bpf-next] bpf: use kvmalloc in map_lookup_elem

On Mon, Aug 16, 2021 at 2:43 PM Daniel Borkmann <daniel@...earbox.net> wrote:
>
> On 8/16/21 6:48 PM, Stanislav Fomichev wrote:
> > Use kvmalloc/kvfree for temporary value when looking up a map.
> > kmalloc might not be sufficient for percpu maps where the value is big.
> >
> > Can be reproduced with netcnt test on qemu with "-smp 255".
> >
> > Signed-off-by: Stanislav Fomichev <sdf@...gle.com>
> > ---
> >   kernel/bpf/syscall.c | 4 ++--
> >   1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> > index 9a2068e39d23..ae0b1c1c8ece 100644
> > --- a/kernel/bpf/syscall.c
> > +++ b/kernel/bpf/syscall.c
> > @@ -1076,7 +1076,7 @@ static int map_lookup_elem(union bpf_attr *attr)
> >       value_size = bpf_map_value_size(map);
> >
> >       err = -ENOMEM;
> > -     value = kmalloc(value_size, GFP_USER | __GFP_NOWARN);
> > +     value = kvmalloc(value_size, GFP_USER | __GFP_NOWARN);
> >       if (!value)
> >               goto free_key;
>
> What about other cases like map_update_elem(), shouldn't they be adapted
> similarly?

And in the same vein (with keys potentially being big as well), should
we switch __bpf_copy_key() to use vmemdup_user() instead of
memdup_user()?

>
> Thanks,
> Daniel