netdev - Re: [PATCH bpf-next v2 2/2] bpf: use kvmalloc for map keys in syscalls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 19 Aug 2021 00:24:41 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Stanislav Fomichev <sdf@...gle.com>, netdev@...r.kernel.org,
        bpf@...r.kernel.org
Cc:     ast@...nel.org, andrii@...nel.org
Subject: Re: [PATCH bpf-next v2 2/2] bpf: use kvmalloc for map keys in
 syscalls

On 8/17/21 5:45 PM, Stanislav Fomichev wrote:
> Same as previous patch but for the keys. memdup_bpfptr is renamed
> to vmemdup_bpfptr (and converted to kvmalloc).
> 
> Signed-off-by: Stanislav Fomichev <sdf@...gle.com>
> ---
>   include/linux/bpfptr.h | 12 ++++++++++--
>   kernel/bpf/syscall.c   | 34 +++++++++++++++++-----------------
>   2 files changed, 27 insertions(+), 19 deletions(-)
> 
> diff --git a/include/linux/bpfptr.h b/include/linux/bpfptr.h
> index 5cdeab497cb3..84eeffb4316a 100644
> --- a/include/linux/bpfptr.h
> +++ b/include/linux/bpfptr.h
> @@ -62,9 +62,17 @@ static inline int copy_to_bpfptr_offset(bpfptr_t dst, size_t offset,
>   	return copy_to_sockptr_offset((sockptr_t) dst, offset, src, size);
>   }
>   
> -static inline void *memdup_bpfptr(bpfptr_t src, size_t len)
> +static inline void *vmemdup_bpfptr(bpfptr_t src, size_t len)

nit: should we just name it kvmemdup_bpfptr() in that case?

>   {
> -	return memdup_sockptr((sockptr_t) src, len);
> +	void *p = kvmalloc(len, GFP_USER | __GFP_NOWARN);
> +
> +	if (!p)
> +		return ERR_PTR(-ENOMEM);
> +	if (copy_from_sockptr(p, (sockptr_t) src, len)) {

Also, I think this one should rather use copy_from_bpfptr() here.

> +		kvfree(p);
> +		return ERR_PTR(-EFAULT);
> +	}
> +	return p;
>   }
>   

Rest lgtm, thanks!