bpf: fix refcnt overflow
authorAlexei Starovoitov <ast@fb.com>
Thu, 28 Apr 2016 01:56:20 +0000 (18:56 -0700)
committerDavid S. Miller <davem@davemloft.net>
Thu, 28 Apr 2016 21:29:45 +0000 (17:29 -0400)
commit92117d8443bc5afacc8d5ba82e541946310f106e
treed0db595b54f82b59049d4b879561c2f97d25e18b
parentbd34cf66cc48a5fb17deb7a1494845c45d71ba8e
bpf: fix refcnt overflow

On a system with >32Gbyte of phyiscal memory and infinite RLIMIT_MEMLOCK,
the malicious application may overflow 32-bit bpf program refcnt.
It's also possible to overflow map refcnt on 1Tb system.
Impose 32k hard limit which means that the same bpf program or
map cannot be shared by more than 32k processes.

Fixes: 1be7f75d1668 ("bpf: enable non-root eBPF programs")
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/bpf.h
kernel/bpf/inode.c
kernel/bpf/syscall.c
kernel/bpf/verifier.c