Skip to content
Commit f9b0e108 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Andrii Nakryiko
Browse files

bpf, mprog: Fix maximum program check on mprog attachment



After Paul's recent improvement to syzkaller to improve coverage for
bpf_mprog and tcx, it hit a splat that the program limit was surpassed.
What happened is that the maximum number of progs got added, followed
by another prog add request which adds with BPF_F_BEFORE flag relative
to the last program in the array. The idx >= bpf_mprog_max() check in
bpf_mprog_attach() still passes because the index is below the maximum
but the maximum will be surpassed. We need to add a check upfront for
insertions to catch this situation.

Fixes: 053c8e1f ("bpf: Add generic attach/detach/query API for multi-progs")
Reported-by: default avatar <syzbot+baa44e3dbbe48e05c1ad@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+b97d20ed568ce0951a06@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+2558ca3567a77b7af4e3@syzkaller.appspotmail.com>
Co-developed-by: default avatarNikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: default avatarNikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Tested-by: default avatar <syzbot+baa44e3dbbe48e05c1ad@syzkaller.appspotmail.com>
Tested-by: default avatar <syzbot+b97d20ed568ce0951a06@syzkaller.appspotmail.com>
Link: https://github.com/google/syzkaller/pull/4207
Link: https://lore.kernel.org/bpf/20230929204121.20305-1-daniel@iogearbox.net
parent b80e31ba
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment