bpf: don't accept cgroup local storage with zero value size

Explicitly forbid creating cgroup local storage maps with zero value
size, as it makes no sense and might even cause a panic.

Reported-by: syzbot+18628320d3b14a5c459c@syzkaller.appspotmail.com
Signed-off-by: Roman Gushchin <guro@fb.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

diff --git a/kernel/bpf/local_storage.c b/kernel/bpf/local_storage.c
index 94126cb..830d7f0 100644 (file)
--- a/kernel/bpf/local_storage.c
+++ b/kernel/bpf/local_storage.c
@@ -195,6 +195,9 @@ static struct bpf_map *cgroup_storage_map_alloc(union bpf_attr *attr)
        if (attr->key_size != sizeof(struct bpf_cgroup_storage_key))
                return ERR_PTR(-EINVAL);
 
+       if (attr->value_size == 0)
+               return ERR_PTR(-EINVAL);
+
        if (attr->value_size > PAGE_SIZE)
                return ERR_PTR(-E2BIG);