lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 504/917] libbpf: Fix BTF header parsing checks
    Date
    From: Andrii Nakryiko <andrii@kernel.org>

    [ Upstream commit c825f5fee19caf301d9821cd79abaa734322de26 ]

    Original code assumed fixed and correct BTF header length. That's not
    always the case, though, so fix this bug with a proper additional check.
    And use actual header length instead of sizeof(struct btf_header) in
    sanity checks.

    Fixes: 8a138aed4a80 ("bpf: btf: Add BTF support to libbpf")
    Reported-by: Evgeny Vereshchagin <evvers@ya.ru>
    Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Link: https://lore.kernel.org/bpf/20211023003157.726961-2-andrii@kernel.org
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    tools/lib/bpf/btf.c | 12 +++++++++---
    1 file changed, 9 insertions(+), 3 deletions(-)

    diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
    index cfd701debcf61..1b9341ef638b0 100644
    --- a/tools/lib/bpf/btf.c
    +++ b/tools/lib/bpf/btf.c
    @@ -231,13 +231,19 @@ static int btf_parse_hdr(struct btf *btf)
    }
    btf_bswap_hdr(hdr);
    } else if (hdr->magic != BTF_MAGIC) {
    - pr_debug("Invalid BTF magic:%x\n", hdr->magic);
    + pr_debug("Invalid BTF magic: %x\n", hdr->magic);
    return -EINVAL;
    }

    - meta_left = btf->raw_size - sizeof(*hdr);
    + if (btf->raw_size < hdr->hdr_len) {
    + pr_debug("BTF header len %u larger than data size %u\n",
    + hdr->hdr_len, btf->raw_size);
    + return -EINVAL;
    + }
    +
    + meta_left = btf->raw_size - hdr->hdr_len;
    if (meta_left < (long long)hdr->str_off + hdr->str_len) {
    - pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
    + pr_debug("Invalid BTF total size: %u\n", btf->raw_size);
    return -EINVAL;
    }

    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 01:50    [W:3.511 / U:0.204 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site