increase upstream eBPF map sizes - #45
Open
liamsmith827 wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A large amount of Android networking functionality is implemented in eBPF. The eBPF maps used by upstream are all too small and the code itself does not fallback to safe behavior when the limits are reached. This can result in lockdown VPN bypass, permission bypass, etc. These limits are frequently reached, which we know because submitted logs often contain E2BIG errors.
This PR raises the limits of the upstream maps to the theoretical maximum size needed (technically slightly below the theoretical maximum due to potential delays in map element removal when stopping a user, but this won't matter in practice). Dynamic allocation is used to prevent resource exhaustion.