lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 494/849] libbpf: Fix overflow in BTF sanity checks
    Date
    From: Andrii Nakryiko <andrii@kernel.org>

    [ Upstream commit 5245dafe3d49efba4d3285cf27ee1cc1eeafafc6 ]

    btf_header's str_off+str_len or type_off+type_len can overflow as they
    are u32s. This will lead to bypassing the sanity checks during BTF
    parsing, resulting in crashes afterwards. Fix by using 64-bit signed
    integers for comparison.

    Fixes: d8123624506c ("libbpf: Fix BTF data layout checks and allow empty BTF")
    Reported-by: Evgeny Vereshchagin <evvers@ya.ru>
    Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Link: https://lore.kernel.org/bpf/20211023003157.726961-1-andrii@kernel.org
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    tools/lib/bpf/btf.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
    index 99d28f04b59d4..3e3ecac43ea9b 100644
    --- a/tools/lib/bpf/btf.c
    +++ b/tools/lib/bpf/btf.c
    @@ -236,12 +236,12 @@ static int btf_parse_hdr(struct btf *btf)
    }

    meta_left = btf->raw_size - sizeof(*hdr);
    - if (meta_left < hdr->str_off + hdr->str_len) {
    + if (meta_left < (long long)hdr->str_off + hdr->str_len) {
    pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
    return -EINVAL;
    }

    - if (hdr->type_off + hdr->type_len > hdr->str_off) {
    + if ((long long)hdr->type_off + hdr->type_len > hdr->str_off) {
    pr_debug("Invalid BTF data sections layout: type data at %u + %u, strings data at %u + %u\n",
    hdr->type_off, hdr->type_len, hdr->str_off, hdr->str_len);
    return -EINVAL;
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 02:40    [W:2.463 / U:0.904 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site