From: Alexei Starovoitov arena_map_alloc() puts max_entries free pages in the range tree of an arena. But the arena kfuncs check their arguments against user_vm_start and user_vm_end. Without map_extra, arena_map_mmap() takes both from the first vma. This vma can be up to 4 GiB long. Then arena_free_pages() also marks pages as free that were never in the range tree. Thus max_entries does not limit the memory of the arena, but these pages are inside kern_vm. Refuse an mmap() longer than max_entries pages with -E2BIG. With map_extra this limit exists already. libbpf always maps max_entries pages. Replace both SZ_4G checks with this limit, because it is at most 4 GiB. Fixes: 317460317a02 ("bpf: Introduce bpf_arena.") Signed-off-by: Alexei Starovoitov --- kernel/bpf/arena.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c index e331130662be..c35b82f44f66 100644 --- a/kernel/bpf/arena.c +++ b/kernel/bpf/arena.c @@ -634,7 +634,7 @@ static unsigned long arena_get_unmapped_area(struct file *filp, unsigned long ad if (pgoff) return -EINVAL; - if (len > SZ_4G) + if (len > (u64)map->max_entries * PAGE_SIZE) return -E2BIG; /* if user_vm_start was specified at arena creation time */ @@ -682,7 +682,7 @@ static int arena_map_mmap(struct bpf_map *map, struct vm_area_struct *vma) return -EBUSY; /* Earlier checks should prevent this */ - if (WARN_ON_ONCE(vma->vm_end - vma->vm_start > SZ_4G || vma->vm_pgoff)) + if (WARN_ON_ONCE(vma_pages(vma) > map->max_entries || vma->vm_pgoff)) return -EFAULT; if (remember_vma(arena, vma)) -- 2.55.0