• Arthur Fabre's avatar
    bpf: Fix out of bounds memory access in bpf_sk_storage · 85749218
    Arthur Fabre authored
    bpf_sk_storage maps use multiple spin locks to reduce contention.
    The number of locks to use is determined by the number of possible CPUs.
    With only 1 possible CPU, bucket_log == 0, and 2^0 = 1 locks are used.
    
    When updating elements, the correct lock is determined with hash_ptr().
    Calling hash_ptr() with 0 bits is undefined behavior, as it does:
    
    x >> (64 - bits)
    
    Using the value results in an out of bounds memory access.
    In my case, this manifested itself as a page fault when raw_spin_lock_bh()
    is called later, when running the self tests:
    
    ./tools/testing/selftests/bpf/test_verifier 773 775
    [   16.366342] BUG: unable to handle page fault for address: ffff8fe7a66f93f8
    
    Force the minimum number of locks to two.
    Signed-off-by: default avatarArthur Fabre <afabre@cloudflare.com>
    Fixes: 6ac99e8f ("bpf: Introduce bpf sk local storage")
    Acked-by: default avatarAndrii Nakryiko <andriin@fb.com>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    85749218
bpf_sk_storage.c 21.7 KB