nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

devmap: Use bpf_map_area_alloc() for allocating hash buckets

Browse source 
Syzkaller discovered that creating a hash of type devmap_hash with a large
number of entries can hit the memory allocator limit for allocating
contiguous memory regions. There's really no reason to use kmalloc_array()
directly in the devmap code, so just switch it to the existing
bpf_map_area_alloc() function that is used elsewhere.

Fixes: 6f9d451ab1 ("xdp: Add devmap_hash map type for looking up devices by hashed index")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20200616142829.114173-1-toke@redhat.com
This commit is contained in:
Toke Høiland-Jørgensen 2020-06-16 16:28:29 +02:00 committed by Alexei Starovoitov
parent 3ff2351651
commit 99c51064fb
1 changed files with 6 additions and 4 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

10
kernel/bpf/devmap.c
View file

@ -86,12 +86,13 @@ static DEFINE_PER_CPU(struct list_head, dev_flush_list);
static DEFINE_SPINLOCK(dev_map_lock); static DEFINE_SPINLOCK(dev_map_lock);
static LIST_HEAD(dev_map_list); static LIST_HEAD(dev_map_list);
static struct hlist_head *dev_map_create_hash(unsigned int entries) static struct hlist_head *dev_map_create_hash(unsigned int entries,
int numa_node)
{ {
int i; int i;
struct hlist_head *hash; struct hlist_head *hash;
hash = kmalloc_array(entries, sizeof(*hash), GFP_KERNEL); hash = bpf_map_area_alloc(entries * sizeof(*hash), numa_node);
if (hash != NULL) if (hash != NULL)
for (i = 0; i < entries; i++) for (i = 0; i < entries; i++)
INIT_HLIST_HEAD(&hash[i]); INIT_HLIST_HEAD(&hash[i]);
@ -145,7 +146,8 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
return -EINVAL; return -EINVAL;
if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) { if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
dtab->dev_index_head = dev_map_create_hash(dtab->n_buckets); dtab->dev_index_head = dev_map_create_hash(dtab->n_buckets,
dtab->map.numa_node);
if (!dtab->dev_index_head) if (!dtab->dev_index_head)
goto free_charge; goto free_charge;
@ -232,7 +234,7 @@ static void dev_map_free(struct bpf_map *map)
} }
} }
kfree(dtab->dev_index_head); bpf_map_area_free(dtab->dev_index_head);
} else { } else {
for (i = 0; i < dtab->map.max_entries; i++) { for (i = 0; i < dtab->map.max_entries; i++) {
struct bpf_dtab_netdev *dev; struct bpf_dtab_netdev *dev;