-
Notifications
You must be signed in to change notification settings - Fork 5
bpf: refactor max_depth computation in bpf_get_stack() #5884
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
bpf: refactor max_depth computation in bpf_get_stack() #5884
Conversation
|
Upstream branch: c9110e6 |
0e26bd3 to
4e70ac0
Compare
|
Upstream branch: abc8a95 |
59e987e to
dbecee5
Compare
4e70ac0 to
c04dd5a
Compare
|
Upstream branch: 929adf8 |
dbecee5 to
f537268
Compare
c04dd5a to
4754b79
Compare
|
Upstream branch: 2d92ef7 |
f537268 to
d4b1d24
Compare
4754b79 to
af15c58
Compare
|
Upstream branch: b338cf8 |
d4b1d24 to
3dd1f00
Compare
|
Upstream branch: b338cf8 |
3dd1f00 to
b1c68e4
Compare
|
Upstream branch: b338cf8 |
b1c68e4 to
6f6cbad
Compare
af15c58 to
c979e9f
Compare
A new helper function stack_map_calculate_max_depth() that computes the max depth for a stackmap. Changes in v2: - Removed the checking 'map_size % map_elem_size' from stack_map_calculate_max_depth - Changed stack_map_calculate_max_depth params name to be more generic Changes in v3: - Changed map size param to size in max depth helper Changes in v4: - Fixed indentation in max depth helper for args Changes in v5: - Bound back trace_nr to num_elem in __bpf_get_stack - Make a copy of sysctl_perf_event_max_stack in stack_map_calculate_max_depth Changes in v6: - Restrained max_depth computation only when required - Additional cleanup from Song in __bpf_get_stack Changes in v7: - Removed additional cleanup from v6 Link to v6: https://lore.kernel.org/all/[email protected]/ Signed-off-by: Arnaud Lecomte <[email protected]> Acked-by: Yonghong Song <[email protected]> Acked-by: Song Liu <[email protected]>
Clean-up bounds checking for trace->nr in __bpf_get_stack by limiting it only to max_depth. Signed-off-by: Arnaud Lecomte <[email protected]> Cc: Song Lui <[email protected]> Acked-by: Song Liu <[email protected]>
Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid() when copying stack trace data. The issue occurs when the perf trace contains more stack entries than the stack map bucket can hold, leading to an out-of-bounds write in the bucket's data array. Changes in v2: - Fixed max_depth names across get stack id Changes in v4: - Removed unnecessary empty line in __bpf_get_stackid Changs in v6: - Added back trace_len computation in __bpf_get_stackid Link to v6: https://lore.kernel.org/all/[email protected]/ Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=c9b724fbb41cf2538b7b Fixes: ee2a098 ("bpf: Adjust BPF stack helper functions to accommodate skip > 0") Signed-off-by: Arnaud Lecomte <[email protected]> Acked-by: Yonghong Song <[email protected]> Acked-by: Yonghong Song <[email protected]>
|
Upstream branch: 9621eb6 |
6f6cbad to
4d4e299
Compare
Pull request for series with
subject: bpf: refactor max_depth computation in bpf_get_stack()
version: 7
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=998624