lkml.org 
[lkml]   [2022]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 60/67] bpf: Fix potential array overflow in bpf_trampoline_get_progs()
    Date
    From: Yuntao Wang <ytcoode@gmail.com>

    commit a2aa95b71c9bbec793b5c5fa50f0a80d882b3e8d upstream.

    The cnt value in the 'cnt >= BPF_MAX_TRAMP_PROGS' check does not
    include BPF_TRAMP_MODIFY_RETURN bpf programs, so the number of
    the attached BPF_TRAMP_MODIFY_RETURN bpf programs in a trampoline
    can exceed BPF_MAX_TRAMP_PROGS.

    When this happens, the assignment '*progs++ = aux->prog' in
    bpf_trampoline_get_progs() will cause progs array overflow as the
    progs field in the bpf_tramp_progs struct can only hold at most
    BPF_MAX_TRAMP_PROGS bpf programs.

    Fixes: 88fd9e5352fe ("bpf: Refactor trampoline update code")
    Signed-off-by: Yuntao Wang <ytcoode@gmail.com>
    Link: https://lore.kernel.org/r/20220430130803.210624-1-ytcoode@gmail.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    kernel/bpf/trampoline.c | 18 ++++++++++++------
    1 file changed, 12 insertions(+), 6 deletions(-)

    --- a/kernel/bpf/trampoline.c
    +++ b/kernel/bpf/trampoline.c
    @@ -411,7 +411,7 @@ int bpf_trampoline_link_prog(struct bpf_
    {
    enum bpf_tramp_prog_type kind;
    int err = 0;
    - int cnt;
    + int cnt = 0, i;

    kind = bpf_attach_type_to_tramp(prog);
    mutex_lock(&tr->mutex);
    @@ -422,7 +422,10 @@ int bpf_trampoline_link_prog(struct bpf_
    err = -EBUSY;
    goto out;
    }
    - cnt = tr->progs_cnt[BPF_TRAMP_FENTRY] + tr->progs_cnt[BPF_TRAMP_FEXIT];
    +
    + for (i = 0; i < BPF_TRAMP_MAX; i++)
    + cnt += tr->progs_cnt[i];
    +
    if (kind == BPF_TRAMP_REPLACE) {
    /* Cannot attach extension if fentry/fexit are in use. */
    if (cnt) {
    @@ -500,16 +503,19 @@ out:

    void bpf_trampoline_put(struct bpf_trampoline *tr)
    {
    + int i;
    +
    if (!tr)
    return;
    mutex_lock(&trampoline_mutex);
    if (!refcount_dec_and_test(&tr->refcnt))
    goto out;
    WARN_ON_ONCE(mutex_is_locked(&tr->mutex));
    - if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[BPF_TRAMP_FENTRY])))
    - goto out;
    - if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[BPF_TRAMP_FEXIT])))
    - goto out;
    +
    + for (i = 0; i < BPF_TRAMP_MAX; i++)
    + if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[i])))
    + goto out;
    +
    /* This code will be executed even when the last bpf_tramp_image
    * is alive. All progs are detached from the trampoline and the
    * trampoline image is patched with jmp into epilogue to skip

    \
     
     \ /
      Last update: 2022-06-03 20:22    [W:3.563 / U:0.168 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site