mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 02:39:48 +00:00
bpf: Prevent increasing bpf_jit_limit above max
[ Upstream commit fadb7ff1a6
]
Restrict bpf_jit_limit to the maximum supported by the arch's JIT.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211014142554.53120-4-lmb@cloudflare.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
a3564fb7b0
commit
b92ac0a9ca
3 changed files with 5 additions and 2 deletions
|
@ -998,6 +998,7 @@ extern int bpf_jit_enable;
|
||||||
extern int bpf_jit_harden;
|
extern int bpf_jit_harden;
|
||||||
extern int bpf_jit_kallsyms;
|
extern int bpf_jit_kallsyms;
|
||||||
extern long bpf_jit_limit;
|
extern long bpf_jit_limit;
|
||||||
|
extern long bpf_jit_limit_max;
|
||||||
|
|
||||||
typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);
|
typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);
|
||||||
|
|
||||||
|
|
|
@ -528,6 +528,7 @@ int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
|
||||||
int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
|
int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
|
||||||
int bpf_jit_harden __read_mostly;
|
int bpf_jit_harden __read_mostly;
|
||||||
long bpf_jit_limit __read_mostly;
|
long bpf_jit_limit __read_mostly;
|
||||||
|
long bpf_jit_limit_max __read_mostly;
|
||||||
|
|
||||||
static void
|
static void
|
||||||
bpf_prog_ksym_set_addr(struct bpf_prog *prog)
|
bpf_prog_ksym_set_addr(struct bpf_prog *prog)
|
||||||
|
@ -821,7 +822,8 @@ u64 __weak bpf_jit_alloc_exec_limit(void)
|
||||||
static int __init bpf_jit_charge_init(void)
|
static int __init bpf_jit_charge_init(void)
|
||||||
{
|
{
|
||||||
/* Only used as heuristic here to derive limit. */
|
/* Only used as heuristic here to derive limit. */
|
||||||
bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2,
|
bpf_jit_limit_max = bpf_jit_alloc_exec_limit();
|
||||||
|
bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2,
|
||||||
PAGE_SIZE), LONG_MAX);
|
PAGE_SIZE), LONG_MAX);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
|
@ -419,7 +419,7 @@ static struct ctl_table net_core_table[] = {
|
||||||
.mode = 0600,
|
.mode = 0600,
|
||||||
.proc_handler = proc_dolongvec_minmax_bpf_restricted,
|
.proc_handler = proc_dolongvec_minmax_bpf_restricted,
|
||||||
.extra1 = &long_one,
|
.extra1 = &long_one,
|
||||||
.extra2 = &long_max,
|
.extra2 = &bpf_jit_limit_max,
|
||||||
},
|
},
|
||||||
#endif
|
#endif
|
||||||
{
|
{
|
||||||
|
|
Loading…
Reference in a new issue