Toke Høiland-Jørgensen c826502bed bpf: Fix DEVMAP_HASH overflow check on 32-bit arches ... [ Upstream commit 281d464a34f540de166cee74b723e97ac2515ec3 ] The devmap code allocates a number hash buckets equal to the next power of two of the max_entries value provided when creating the map. When rounding up to the next power of two, the 32-bit variable storing the number of buckets can overflow, and the code checks for overflow by checking if the truncated 32-bit value is equal to 0. However, on 32-bit arches the rounding up itself can overflow mid-way through, because it ends up doing a left-shift of 32 bits on an unsigned long value. If the size of an unsigned long is four bytes, this is undefined behaviour, so there is no guarantee that we'll end up with a nice and tidy 0-value at the end. Syzbot managed to turn this into a crash on arm32 by creating a DEVMAP_HASH with max_entries > 0x80000000 and then trying to update it. Fix this by moving the overflow check to before the rounding up operation. Fixes: 6f9d451ab1 ("xdp: Add devmap_hash map type for looking up devices by hashed index") Link: https://lore.kernel.org/r/000000000000ed666a0611af6818@google.com Reported-and-tested-by: syzbot+8cd36f6b65f3cafd400a@syzkaller.appspotmail.com Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Message-ID: <20240307120340.99577-2-toke@redhat.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-03-26 18:21:22 -04:00
..
bpf	bpf: Fix DEVMAP_HASH overflow check on 32-bit arches	2024-03-26 18:21:22 -04:00
cgroup	cgroup: Remove duplicates in cgroup v1 tasks file	2023-10-19 23:05:37 +02:00
configs	…
debug	kdb: Fix a potential buffer overflow in kdb_local()	2024-01-25 14:52:54 -08:00
dma	dma-mapping: clear dev->dma_mem to NULL after freeing it	2024-01-25 14:52:38 -08:00
entry	entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up	2023-03-30 12:47:51 +02:00
events	perf: Fix the nr_addr_filters fix	2024-02-23 08:54:52 +01:00
futex	futex: Don't include process MM in futex key on no-MMU	2023-11-20 11:08:13 +01:00
gcov	…
irq	genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware	2023-11-28 16:56:30 +00:00
kcsan	kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures	2023-07-23 13:47:12 +02:00
livepatch	livepatch: Fix missing newline character in klp_resolve_symbols()	2023-11-20 11:08:25 +01:00
locking	lockdep: Fix block chain corruption	2023-12-03 07:31:23 +01:00
power	PM: hibernate: Enforce ordering during image compression/decompression	2024-02-23 08:54:23 +01:00
printk	printk: Consolidate console deferred printing	2023-09-23 11:09:59 +02:00
rcu	rcu-tasks: Provide rcu_trace_implies_rcu_gp()	2024-03-26 18:21:11 -04:00
sched	sched/fair: Take the scheduling domain into account in select_idle_core()	2024-03-26 18:21:15 -04:00
time	timekeeping: Fix cross-timestamp interpolation for non-x86	2024-03-26 18:21:15 -04:00
trace	bpf: Remove trace_printk_lock	2024-03-01 13:21:43 +01:00
.gitignore	…
Kconfig.freezer	…
Kconfig.hz	…
Kconfig.locks	…
Kconfig.preempt	…
Makefile	…
acct.c	…
async.c	async: Introduce async_schedule_dev_nocall()	2024-02-23 08:54:25 +01:00
audit.c	audit: Send netlink ACK before setting connection in auditd_set	2024-02-23 08:54:37 +01:00
audit.h	…
audit_fsnotify.c	…
audit_tree.c	…
audit_watch.c	audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()	2023-11-28 16:56:27 +00:00
auditfilter.c	…
auditsc.c	audit: fix possible soft lockup in __audit_inode_child()	2023-09-19 12:22:39 +02:00
backtracetest.c	…
bounds.c	…
capability.c	…
cfi.c	…
compat.c	sched_getaffinity: don't assume 'cpumask_size()' is fully initialized	2023-04-05 11:24:53 +02:00
configs.c	…
context_tracking.c	…
cpu.c	hrtimers: Push pending hrtimers away from outgoing CPU earlier	2023-12-13 18:36:31 +01:00
cpu_pm.c	…
crash_core.c	…
crash_dump.c	…
cred.c	cred: switch to using atomic_long_t	2023-12-20 15:17:37 +01:00
delayacct.c	…
dma.c	…
exec_domain.c	…
exit.c	…
extable.c	…
fail_function.c	kernel/fail_function: fix memory leak with using debugfs_lookup()	2023-03-11 13:57:38 +01:00
fork.c	kernel/fork: beware of __put_task_struct() calling context	2023-09-23 11:09:55 +02:00
freezer.c	…
gen_kheaders.sh	…
groups.c	…
hung_task.c	…
iomem.c	…
irq_work.c	…
jump_label.c	…
kallsyms.c	kallsyms: Make kallsyms_on_each_symbol generally available	2023-12-13 18:36:45 +01:00
kcmp.c	…
kcov.c	…
kexec.c	kernel: kexec: copy user-array safely	2023-11-28 16:56:16 +00:00
kexec_core.c	kexec: fix a memory leak in crash_shrink_memory()	2023-07-23 13:46:52 +02:00
kexec_elf.c	…
kexec_file.c	kexec: support purgatories with .text.hot sections	2023-06-21 15:59:14 +02:00
kexec_internal.h	panic, kexec: make __crash_kexec() NMI safe	2023-04-20 12:13:57 +02:00
kheaders.c	kheaders: Use array declaration instead of char	2023-05-11 23:00:17 +09:00
kmod.c	…
kprobes.c	kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list	2024-01-25 14:52:31 -08:00
ksysfs.c	kexec: turn all kexec_mutex acquisitions into trylocks	2023-04-20 12:13:57 +02:00
kthread.c	kthread: add the helper function kthread_run_on_cpu()	2023-03-30 12:47:42 +02:00
latencytop.c	…
module-internal.h	…
module.c	kallsyms: Make module_kallsyms_on_each_symbol generally available	2024-01-15 18:51:26 +01:00
module_signature.c	…
module_signing.c	…
notifier.c	…
nsproxy.c	…
padata.c	crypto: pcrypt - Fix hungtask for PADATA_RESET	2023-11-28 16:56:18 +00:00
panic.c	…
params.c	…
pid.c	…
pid_namespace.c	…
profile.c	…
ptrace.c	…
range.c	…
reboot.c	kernel/reboot: emergency_restart: Set correct system_state	2023-11-28 16:56:31 +00:00
regset.c	…
relay.c	relayfs: fix out-of-bounds access in relay_file_read	2023-05-11 23:00:18 +09:00
resource.c	dax/kmem: Fix leak of memory-hotplug resources	2023-03-10 09:40:08 +01:00
resource_kunit.c	…
rseq.c	…
scftorture.c	scftorture: Forgive memory-allocation failure if KASAN	2023-09-23 11:09:55 +02:00
scs.c	…
seccomp.c	…
signal.c	…
smp.c	…
smpboot.c	…
smpboot.h	…
softirq.c	timers/nohz: Last resort update jiffies on nohz_full IRQ entry	2023-08-16 18:22:04 +02:00
stackleak.c	…
stacktrace.c	…
static_call.c	…
static_call_inline.c	…
stop_machine.c	…
sys.c	getrusage: use sig->stats_lock rather than lock_task_sighand()	2024-03-15 10:48:22 -04:00
sys_ni.c	…
sysctl-test.c	…
sysctl.c	sched/rt: Disallow writing invalid values to sched_rt_period_us	2024-03-01 13:21:43 +01:00
task_work.c	…
taskstats.c	…
test_kprobes.c	…
torture.c	torture: Fix hang during kthread shutdown phase	2023-08-30 16:18:19 +02:00
tracepoint.c	…
tsacct.c	…
ucount.c	…
uid16.c	…
uid16.h	…
umh.c	…
up.c	…
user-return-notifier.c	…
user.c	…
user_namespace.c	…
usermode_driver.c	…
utsname.c	…
utsname_sysctl.c	…
watch_queue.c	kernel: watch_queue: copy user-array safely	2023-11-28 16:56:16 +00:00
watchdog.c	watchdog: move softlockup_panic back to early_param	2023-11-28 16:56:28 +00:00
watchdog_hld.c	watchdog/perf: more properly prevent false positives with turbo modes	2023-07-23 13:46:52 +02:00
workqueue.c	Revert "workqueue: remove unused cancel_work()"	2023-12-08 08:48:03 +01:00
workqueue_internal.h	…