Patch "bpf: Limit the number of uprobes when attaching program to multiple uprobes" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Limit the number of uprobes when attaching program to multiple uprobes

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-limit-the-number-of-uprobes-when-attaching-progr.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e6345942c9f89f0b9e570b8dd275d7e4428ea945
Author: Hou Tao <houtao1@xxxxxxxxxx>
Date:   Fri Dec 15 18:07:04 2023 +0800

    bpf: Limit the number of uprobes when attaching program to multiple uprobes
    
    [ Upstream commit 8b2efe51ba85ca83460941672afac6fca4199df6 ]
    
    An abnormally big cnt may be passed to link_create.uprobe_multi.cnt,
    and it will trigger the following warning in kvmalloc_node():
    
            if (unlikely(size > INT_MAX)) {
                    WARN_ON_ONCE(!(flags & __GFP_NOWARN));
                    return NULL;
            }
    
    Fix the warning by limiting the maximal number of uprobes in
    bpf_uprobe_multi_link_attach(). If the number of uprobes is greater than
    MAX_UPROBE_MULTI_CNT, the attachment will return -E2BIG.
    
    Fixes: 89ae89f53d20 ("bpf: Add multi uprobe link")
    Reported-by: Xingwei Lee <xrivendell7@xxxxxxxxx>
    Signed-off-by: Hou Tao <houtao1@xxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Acked-by: Jiri Olsa <jolsa@xxxxxxxxxx>
    Acked-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
    Closes: https://lore.kernel.org/bpf/CABOYnLwwJY=yFAGie59LFsUsBAgHfroVqbzZ5edAXbFE3YiNVA@xxxxxxxxxxxxxx
    Link: https://lore.kernel.org/bpf/20231215100708.2265609-2-houtao@xxxxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 868008f56fec..39c4cef98b95 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -41,6 +41,8 @@
 #define bpf_event_rcu_dereference(p)					\
 	rcu_dereference_protected(p, lockdep_is_held(&bpf_event_mutex))
 
+#define MAX_UPROBE_MULTI_CNT (1U << 20)
+
 #ifdef CONFIG_MODULES
 struct bpf_trace_module {
 	struct module *module;
@@ -3198,6 +3200,8 @@ int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
 
 	if (!upath || !uoffsets || !cnt)
 		return -EINVAL;
+	if (cnt > MAX_UPROBE_MULTI_CNT)
+		return -E2BIG;
 
 	uref_ctr_offsets = u64_to_user_ptr(attr->link_create.uprobe_multi.ref_ctr_offsets);
 	ucookies = u64_to_user_ptr(attr->link_create.uprobe_multi.cookies);