Patch "bpf: Limit the number of kprobes when attaching program to multiple kprobes" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Limit the number of kprobes when attaching program to multiple kprobes

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-limit-the-number-of-kprobes-when-attaching-progr.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b52e6424bc091c3db5627858b03d5830ddadebab
Author: Hou Tao <houtao1@xxxxxxxxxx>
Date:   Fri Dec 15 18:07:05 2023 +0800

    bpf: Limit the number of kprobes when attaching program to multiple kprobes
    
    [ Upstream commit d6d1e6c17cab2dcb7b8530c599f00e7de906d380 ]
    
    An abnormally big cnt may also be assigned to kprobe_multi.cnt when
    attaching multiple kprobes. It will trigger the following warning in
    kvmalloc_node():
    
            if (unlikely(size > INT_MAX)) {
                WARN_ON_ONCE(!(flags & __GFP_NOWARN));
                return NULL;
            }
    
    Fix the warning by limiting the maximal number of kprobes in
    bpf_kprobe_multi_link_attach(). If the number of kprobes is greater than
    MAX_KPROBE_MULTI_CNT, the attachment will fail and return -E2BIG.
    
    Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
    Signed-off-by: Hou Tao <houtao1@xxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Acked-by: Jiri Olsa <jolsa@xxxxxxxxxx>
    Acked-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20231215100708.2265609-3-houtao@xxxxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 39c4cef98b95..1d76f3b014ae 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -42,6 +42,7 @@
 	rcu_dereference_protected(p, lockdep_is_held(&bpf_event_mutex))
 
 #define MAX_UPROBE_MULTI_CNT (1U << 20)
+#define MAX_KPROBE_MULTI_CNT (1U << 20)
 
 #ifdef CONFIG_MODULES
 struct bpf_trace_module {
@@ -2897,6 +2898,8 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
 	cnt = attr->link_create.kprobe_multi.cnt;
 	if (!cnt)
 		return -EINVAL;
+	if (cnt > MAX_KPROBE_MULTI_CNT)
+		return -E2BIG;
 
 	size = cnt * sizeof(*addrs);
 	addrs = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL);