iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
96e5ae4e76f1ea950d493f510399b49308bea731
linux/kernel
History
Eric Dumazet 96e5ae4e76 bpf: fix numa_node validation 
syzkaller reported crashes in bpf map creation or map update [1]

Problem is that nr_node_ids is a signed integer,
NUMA_NO_NODE is also an integer, so it is very tempting
to declare numa_node as a signed integer.

This means the typical test to validate a user provided value :

        if (numa_node != NUMA_NO_NODE &&
            (numa_node >= nr_node_ids ||
             !node_online(numa_node)))

must be written :

        if (numa_node != NUMA_NO_NODE &&
            ((unsigned int)numa_node >= nr_node_ids ||
             !node_online(numa_node)))

[1]
kernel BUG at mm/slab.c:3256!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 2946 Comm: syzkaller916108 Not tainted 4.13.0-rc7+ #35
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d2bc60c0 task.stack: ffff8801c0c90000
RIP: 0010:____cache_alloc_node+0x1d4/0x1e0 mm/slab.c:3292
RSP: 0018:ffff8801c0c97638 EFLAGS: 00010096
RAX: ffffffffffff8b7b RBX: 0000000001080220 RCX: 0000000000000000
RDX: 00000000ffff8b7b RSI: 0000000001080220 RDI: ffff8801dac00040
RBP: ffff8801c0c976c0 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8801c0c97620 R11: 0000000000000001 R12: ffff8801dac00040
R13: ffff8801dac00040 R14: 0000000000000000 R15: 00000000ffff8b7b
FS:  0000000002119940(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020001fec CR3: 00000001d2980000 CR4: 00000000001406f0
Call Trace:
 __do_kmalloc_node mm/slab.c:3688 [inline]
 __kmalloc_node+0x33/0x70 mm/slab.c:3696
 kmalloc_node include/linux/slab.h:535 [inline]
 alloc_htab_elem+0x2a8/0x480 kernel/bpf/hashtab.c:740
 htab_map_update_elem+0x740/0xb80 kernel/bpf/hashtab.c:820
 map_update_elem kernel/bpf/syscall.c:587 [inline]
 SYSC_bpf kernel/bpf/syscall.c:1468 [inline]
 SyS_bpf+0x20c5/0x4c40 kernel/bpf/syscall.c:1443
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x440409
RSP: 002b:00007ffd1f1792b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440409
RDX: 0000000000000020 RSI: 0000000020006000 RDI: 0000000000000002
RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401d70
R13: 0000000000401e00 R14: 0000000000000000 R15: 0000000000000000
Code: 83 c2 01 89 50 18 4c 03 70 08 e8 38 f4 ff ff 4d 85 f6 0f 85 3e ff ff ff 44 89 fe 4c 89 ef e8 94 fb ff ff 49 89 c6 e9 2b ff ff ff <0f> 0b 0f 0b 0f 0b 66 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41
RIP: ____cache_alloc_node+0x1d4/0x1e0 mm/slab.c:3292 RSP: ffff8801c0c97638
---[ end trace d745f355da2e33ce ]---
Kernel panic - not syncing: Fatal exception

Fixes: 96eabe7a40 ("bpf: Allow selecting numa node during map creation")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Martin KaFai Lau <kafai@fb.com>
Cc: Alexei Starovoitov <ast@fb.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-09-05 09:10:02 -07:00
..
bpf
bpf: fix numa_node validation
2017-09-05 09:10:02 -07:00
cgroup
Merge branch 'for-4.13-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2017-08-29 11:16:21 -07:00
configs
config: android-base: disable CONFIG_NFSD and CONFIG_NFS_FS
2017-06-09 11:47:38 +02:00
debug
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>
2017-03-02 08:42:34 +01:00
events
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-09-01 17:42:05 -07:00
gcov
gcov: support GCC 7.1
2017-05-12 15:57:15 -07:00
irq
genirq/ipi: Fixup checks against nr_cpu_ids
2017-08-20 10:49:05 +02:00
livepatch
livepatch: Fix stacking of patches with respect to RCU
2017-06-20 10:42:19 +02:00
locking
Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2017-07-21 11:11:23 -07:00
power
mm: fix global NR_SLAB_.*CLAIMABLE counter reads
2017-08-10 15:54:06 -07:00
printk
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk
2017-07-05 11:11:26 -07:00
rcu
rcu: Remove RCU CPU stall warnings from Tiny RCU
2017-06-08 18:52:45 -07:00
sched
Minor page waitqueue cleanups
2017-08-27 13:55:12 -07:00
time
timers: Fix excessive granularity of new timers after a nohz idle
2017-08-24 11:40:18 +02:00
trace
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-09-01 17:42:05 -07:00
.gitignore
…
acct.c
sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>
2017-03-02 08:42:39 +01:00
async.c
async: Adjust system_state checks
2017-05-23 10:01:37 +02:00
audit_fsnotify.c
Merge branch 'fsnotify' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2017-05-03 11:05:15 -07:00
audit_tree.c
Merge branch 'fsnotify' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2017-05-03 11:05:15 -07:00
audit_watch.c
Merge tag 'audit-pr-20170816' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
2017-08-16 16:48:34 -07:00
audit.c
Merge branch 'stable-4.13' of git://git.infradead.org/users/pcmoore/audit
2017-07-20 10:22:26 -07:00
audit.h
audit: style fix
2017-06-12 18:07:43 -04:00
auditfilter.c
audit: kernel generated netlink traffic should have a portid of 0
2017-05-02 10:16:05 -04:00
auditsc.c
Merge branch 'stable-4.13' of git://git.infradead.org/users/pcmoore/audit
2017-07-05 11:24:05 -07:00
backtracetest.c
…
bounds.c
…
capability.c
capability: export has_capability
2017-01-12 07:01:56 -07:00
compat.c
Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-07-06 20:57:13 -07:00
configs.c
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
context_tracking.c
…
cpu_pm.c
…
cpu.c
smp/hotplug: Replace BUG_ON and react useful
2017-07-11 22:25:44 +02:00
crash_core.c
kdump: protect vmcoreinfo data under the crash memory
2017-07-12 16:26:00 -07:00
crash_dump.c
…
cred.c
doc: ReSTify credentials.txt
2017-05-18 10:30:19 -06:00
delayacct.c
sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>
2017-03-02 08:42:39 +01:00
dma.c
…
elfcore.c
…
exec_domain.c
…
exit.c
kernel/exit.c: avoid undefined behaviour when calling wait4()
2017-07-10 16:32:36 -07:00
extable.c
lib/extable.c: use bsearch() library function in search_extable()
2017-07-10 16:32:35 -07:00
fork.c
mm, uprobes: fix multiple free of ->uprobes_state.xol_area
2017-08-31 16:33:15 -07:00
freezer.c
…
futex_compat.c
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
futex.c
futex: Remove unnecessary warning from get_futex_key
2017-08-09 14:00:54 -07:00
groups.c
kernel/groups.c: use sort library function
2017-07-10 16:32:34 -07:00
hung_task.c
kernel/hung_task.c: defer showing held locks
2017-05-08 17:15:10 -07:00
irq_work.c
…
jump_label.c
jump_label: Reorder hotplug lock and jump_label_lock
2017-05-26 10:10:45 +02:00
kallsyms.c
kernel/kallsyms.c: replace all_var with IS_ENABLED(CONFIG_KALLSYMS_ALL)
2017-07-10 16:32:34 -07:00
kcmp.c
kcmp: add KCMP_EPOLL_TFD mode to compare epoll target files
2017-07-12 16:26:01 -07:00
Kconfig.freezer
…
Kconfig.hz
…
Kconfig.locks
locking/mutex: Allow MUTEX_SPIN_ON_OWNER when DEBUG_MUTEXES
2016-10-25 11:31:51 +02:00
Kconfig.preempt
…
kcov.c
kcov: simplify interrupt check
2017-05-08 17:15:12 -07:00
kexec_core.c
kdump: protect vmcoreinfo data under the crash memory
2017-07-12 16:26:00 -07:00
kexec_file.c
kexec_file: adjust declaration of kexec_purgatory
2017-07-12 16:26:02 -07:00
kexec_internal.h
kexec_file: adjust declaration of kexec_purgatory
2017-07-12 16:26:02 -07:00
kexec.c
kdump: protect vmcoreinfo data under the crash memory
2017-07-12 16:26:00 -07:00
kmod.c
kmod: fix wait on recursive loop
2017-08-18 15:32:01 -07:00
kprobes.c
kprobes: Ensure that jprobe probepoints are at function entry
2017-07-08 11:05:35 +02:00
ksysfs.c
kexec: move vmcoreinfo out of the kernel's .bss section
2017-07-12 16:25:59 -07:00
kthread.c
kernel/kthread.c: kthread_worker: don't hog the cpu
2017-08-31 16:33:15 -07:00
latencytop.c
sched/headers: Prepare to move sched_info_on() and force_schedstat_enabled() from <linux/sched.h> to <linux/sched/stat.h>
2017-03-02 08:42:39 +01:00
Makefile
kernel/watchdog: split up config options
2017-07-12 16:26:02 -07:00
membarrier.c
Fix: Disable sys_membarrier when nohz_full is enabled
2017-01-23 11:32:16 -08:00
memremap.c
mm, memory_hotplug: replace for_device by want_memblock in arch_add_memory
2017-07-06 16:24:32 -07:00
module_signing.c
…
module-internal.h
…
module.c
Merge tag 'modules-for-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux
2017-07-12 17:22:01 -07:00
notifier.c
kernel/notifier.c: simplify expression
2017-02-24 17:46:56 -08:00
nsproxy.c
perf: Add PERF_RECORD_NAMESPACES to include namespaces related info
2017-03-13 15:57:41 -03:00
padata.c
padata: Avoid nested calls to cpus_read_lock() in pcrypt_init_padata()
2017-05-26 10:10:37 +02:00
panic.c
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>
2017-03-02 08:42:34 +01:00
params.c
boot/param: Move next_arg() function to lib/cmdline.c for later reuse
2017-04-18 10:37:13 +02:00
pid_namespace.c
pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
2017-05-13 17:26:01 -05:00
pid.c
pids: make task_tgid_nr_ns() safe
2017-08-21 12:47:31 -07:00
profile.c
sched/headers: Prepare to move sched_info_on() and force_schedstat_enabled() from <linux/sched.h> to <linux/sched/stat.h>
2017-03-02 08:42:39 +01:00
ptrace.c
ptrace: Properly initialize ptracer_cred on fork
2017-05-23 07:40:44 -05:00
range.c
…
reboot.c
…
relay.c
Merge branch 'work.splice' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-05-02 11:38:06 -07:00
resource.c
…
seccomp.c
seccomp: Switch from atomic_t to recount_t
2017-06-26 09:24:00 -07:00
signal.c
signal: don't remove SIGNAL_UNKILLABLE for traced tasks.
2017-08-18 15:32:02 -07:00
smp.c
smp, cpumask: Use non-atomic cpumask_{set,clear}_cpu()
2017-05-23 10:01:32 +02:00
smpboot.c
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>
2017-03-02 08:42:35 +01:00
smpboot.h
…
softirq.c
sched/core: Remove 'task' parameter and rename tsk_restore_flags() to current_restore_flags()
2017-04-11 09:06:32 +02:00
stacktrace.c
stacktrace/x86: add function for detecting reliable stack traces
2017-03-08 09:18:02 +01:00
stop_machine.c
stop_machine: Provide stop_machine_cpuslocked()
2017-05-26 10:10:36 +02:00
sys_ni.c
move aio compat to fs/aio.c
2016-12-22 22:58:37 -05:00
sys.c
fix a braino in compat_sys_getrlimit()
2017-07-12 09:15:00 -07:00
sysctl_binary.c
kernel/sysctl_binary.c: check name array length in deprecated_sysctl_warning()
2017-07-12 16:26:00 -07:00
sysctl.c
kernel/watchdog: split up config options
2017-07-12 16:26:02 -07:00
task_work.c
…
taskstats.c
taskstats: add e/u/stime for TGID command
2017-05-08 17:15:12 -07:00
test_kprobes.c
…
torture.c
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/clock.h>
2017-03-02 08:42:27 +01:00
tracepoint.c
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>
2017-03-02 08:42:35 +01:00
tsacct.c
sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>
2017-03-02 08:42:39 +01:00
ucount.c
ucount: Remove the atomicity from ucount->count
2017-03-06 15:26:37 -06:00
uid16.c
sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>
2017-03-02 08:42:31 +01:00
up.c
smp: Add function to execute a function synchronously on a CPU
2016-09-05 13:52:39 +02:00
user_namespace.c
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>
2017-03-02 08:42:29 +01:00
user-return-notifier.c
…
user.c
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/user.h>
2017-03-02 08:42:29 +01:00
utsname_sysctl.c
sched/headers: Remove <linux/rwsem.h> from <linux/sched.h>
2017-03-03 01:45:36 +01:00
utsname.c
sched/headers: Prepare to move the task_lock()/unlock() APIs to <linux/sched/task.h>
2017-03-02 08:42:38 +01:00
watchdog_hld.c
kernel/watchdog: Prevent false positives with turbo modes
2017-08-18 12:35:02 +02:00
watchdog.c
kernel/watchdog: Prevent false positives with turbo modes
2017-08-18 12:35:02 +02:00
workqueue_internal.h
…
workqueue.c
workqueue: Work around edge cases for calc of pool's cpumask
2017-07-28 11:05:52 -04:00