Skip to contentSkip to conversation

bpf: Limit signature size to KMALLOC_MAX_CACHE_SIZE

PATCH In review KP Singh 3 participants 3 messages Feb 5

Subsystems (2)
BPF BPF core
lore
Share & tools
lore

KP Singh

author
#0 lore raw

PATCH v3 1/1 bpf: Limit signature size to KMALLOC_MAX_CACHE_SIZE

Practical BPF signatures are significantly smaller than KMALLOC_MAX_CACHE_SIZE

Allowing larger sizes opens the door for abuse by passing excessive size values and forcing the kernel into expensive allocation paths (via kmalloc_large or vmalloc).

Fixes 349271568303 ("bpf: Implement signature verification for BPF programs")
Reported-by Chris Mason <[email protected]>
Signed-off-by KP Singh <[email protected]>
---
 kernel/bpf/syscall.c | 6 ++++++
 1 file changed, 6 insertions(+)
kernel/bpf/syscall.c +6 -0
index 4ff82144f885..15e87f507991 100644
@@ -2820,6 +2820,12 @@ static int bpf_prog_verify_signature(struct bpf_prog *prog, union bpf_attr *attr
 	void *sig;
 	int err = 0;
 
+	/* Don't attempt to use kmalloc_large or vmalloc for signatures.
+	 * Practical signature for BPF program should be below this limit.
+	 */
+	if (attr->signature_size > KMALLOC_MAX_CACHE_SIZE)
+		return -EINVAL;
+
 	if (system_keyring_id_check(attr->keyring_id) == 0)
 		key = bpf_lookup_system_key(attr->keyring_id);
 	else
Signature · 1 line
2.43.0
maintainer Acked-by on v3 1/1
#1 lore raw
Quoted 10 lines · KP Singh

Practical BPF signatures are significantly smaller than KMALLOC_MAX_CACHE_SIZE

Allowing larger sizes opens the door for abuse by passing excessive size values and forcing the kernel into expensive allocation paths (via kmalloc_large or vmalloc).

Fixes 349271568303 ("bpf: Implement signature verification for BPF programs")
Reported-by Chris Mason <[email protected]>
Signed-off-by KP Singh <[email protected]>

[ tree would be bpf-next ]

Acked-by Daniel Borkmann <[email protected]>
Quoted 1 line

---

Next time pls add a small changelog below the "---".

Quoted 3 lines
  kernel/bpf/syscall.c | 6 ++++++
  1 file changed, 6 insertions(+)

Thanks,
Daniel

#2 lore raw
In reply to KP Singh
Quoted 20 lines · KP Singh

Practical BPF signatures are significantly smaller than KMALLOC_MAX_CACHE_SIZE

Allowing larger sizes opens the door for abuse by passing excessive size values and forcing the kernel into expensive allocation paths (via kmalloc_large or vmalloc).

Fixes 349271568303 ("bpf: Implement signature verification for BPF programs")
Reported-by Chris Mason <[email protected]>
Signed-off-by KP Singh <[email protected]>
---
 kernel/bpf/syscall.c | 6 ++++++
 1 file changed, 6 insertions(+)
kernel/bpf/syscall.c +0 -0
index 4ff82144f885..15e87f507991 100644

kernel/bpf/syscall.c static int bpf_prog_verify_signature(struct bpf_prog *prog, union bpf_attr *attr · line 2825

Quoted 6 lines
kernel/bpf/syscall.c +3 -0
@@ -2820,6 +2820,12 @@ static int bpf_prog_verify_signature(struct bpf_prog *prog, union bpf_attr *attr
        void *sig;
        int err = 0;
 
+       /* Don't attempt to use kmalloc_large or vmalloc for signatures.
+        * Practical signature for BPF program should be below this limit.
+        */

Applied and adjusted comment to be in proper kernel style. We don't use networking style in new code any more.