Re: EBPF-triggered WARNING at mm/percpu.c:1361 in v4-14-rc2

[Daniel Borkmann]

On 09/28/2017 04:45 PM, Mark Rutland wrote:
> On Thu, Sep 28, 2017 at 04:37:46PM +0200, Daniel Borkmann wrote:
> > On 09/28/2017 01:27 PM, Mark Rutland wrote:
> > > Hi,
> > >
> > > While fuzzing v4.14-rc2 with Syzkaller, I found it was possible to trigger the
> > > warning at mm/percpu.c:1361, on both arm64 and x86_64. This appears to require
> > > increasing RLIMIT_MEMLOCK, so to the best of my knowledge this cannot be
> > > triggered by an unprivileged user.
> > >
> > > I've included example splats for both x86_64 and arm64, along with a C
> > > reproducer, inline below.
> > >
> > > It looks like dev_map_alloc() requests a percpu alloction of 32776 bytes, which
> > > is larger than the maximum supported allocation size of 32768 bytes.
> > >
> > > I wonder if it would make more sense to pr_warn() for sizes that are too
> > > large, so that callers don't have to roll their own checks against
> > > PCPU_MIN_UNIT_SIZE?
> >
> > Perhaps the pr_warn() should be ratelimited; or could there be an
> > option where we only return NULL, not triggering a warn at all (which
> > would likely be what callers might do anyway when checking against
> > PCPU_MIN_UNIT_SIZE and then bailing out)?
>
> Those both make sense to me; checking __GFP_NOWARN should be easy
> enough.
>
> Just to check, do you think that dev_map_alloc() should explicitly test
> the size against PCPU_MIN_UNIT_SIZE, prior to calling pcpu_alloc()?

Looks like there are users of __alloc_percpu_gfp() with __GFP_NOWARN
in couple of places already, but __GFP_NOWARN is ignored. Would make
sense to support that indeed to avoid throwing the warn and just let
the caller bail out when it sees the NULL as usual. In some cases (like
the current ones) this makes sense, others probably not too much and
a WARN would be preferred way, but __alloc_percpu_gfp() could provide
such option to simplify some of the code that pre checks against the
limit on PCPU_MIN_UNIT_SIZE before calling the allocator and doesn't
throw a WARN either; and most likely such check is just to prevent
the user from seeing exactly this splat.

Thanks,
Daniel