Re: [PATCH bpf v4 1/3] bpf_trace: check size for overflow in bpf_kprobe_multi_link_attach

[Yonghong Song]

On 5/19/22 11:14 AM, Eugene Syromiatnikov wrote:
> Check that size would not overflow before calculation (and return
> -EOVERFLOW if it will), to prevent potential out-of-bounds write
> with the following copy_from_user.  Add the same check
> to kprobe_multi_resolve_syms in case it will be called from elsewhere
> in the future.  The INT_MAX checks are performed in order to avoid
> triggering kvmalloc_node warning [1].
>
> [1] https://lore.kernel.org/lkml/cfe6abea-8d00-8f8c-f84c-e6f27753b5d1@xxxxxx/
>
> Fixes: 0dcac272540613d4 ("bpf: Add multi kprobe link")
> Signed-off-by: Eugene Syromiatnikov <esyr@xxxxxxxxxx>

Acked-by: Yonghong Song <yhs@xxxxxx>