Hi,
On Tue, Feb 1, 2022 at 10:25 AM htbegin <hotforest@xxxxxxxxx> wrote:
>
> Hi,
>
> On Tue, Feb 1, 2022 at 12:28 AM Daniel Borkmann <daniel@xxxxxxxxxxxxx> wrote:
> >
> > On 1/31/22 12:46 PM, Hou Tao wrote:
> > > Now the ringbuf area in /proc/vmallocinfo is showed as vmalloc,
> > > but VM_ALLOC is only used for vmalloc(), and for the ringbuf area
> > > it is created by mapping allocated pages, so use VM_MAP instead.
> > >
> > > After the change, ringbuf info in /proc/vmallocinfo will changed from:
> > > [start]-[end] 24576 ringbuf_map_alloc+0x171/0x290 vmalloc user
> > > to
> > > [start]-[end] 24576 ringbuf_map_alloc+0x171/0x290 vmap user
> >
> > Could you elaborate in the commit msg if this also has some other internal
> > effect aside from the /proc/vmallocinfo listing? Thanks!
> >
> For now, the VM_MAP flag only affects the output in /proc/vmallocinfo.
Just find out that the VM_ALLOC will be used to check whether or not
the mapped area needs to be marked as accessible by commit
2fd3fb0be1d1 ("kasan, vmalloc: unpoison VM_ALLOC pages after mapping").
And the patch can fix the vmalloc oob access reported by syzbot [1] ,
I will post v2
to illustrate that.
Regards,
Tao
[1]: https://lore.kernel.org/bpf/0000000000000a9b7d05d6ee565f@xxxxxxxxxx/T/#u
>
> Thanks,
> Tao
> > > Signed-off-by: Hou Tao <houtao1@xxxxxxxxxx>
> > > ---
> > > kernel/bpf/ringbuf.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c
> > > index 638d7fd7b375..710ba9de12ce 100644
> > > --- a/kernel/bpf/ringbuf.c
> > > +++ b/kernel/bpf/ringbuf.c
> > > @@ -104,7 +104,7 @@ static struct bpf_ringbuf *bpf_ringbuf_area_alloc(size_t data_sz, int numa_node)
> > > }
> > >
> > > rb = vmap(pages, nr_meta_pages + 2 * nr_data_pages,
> > > - VM_ALLOC | VM_USERMAP, PAGE_KERNEL);
> > > + VM_MAP | VM_USERMAP, PAGE_KERNEL);
> > > if (rb) {
> > > kmemleak_not_leak(pages);
> > > rb->pages = pages;
> > >
> >
