kevin/linux
1
Fork 0
Code

Merge branch 'bpf-fix-incorrect-name-check-pass-logic-in-btf_name_valid_section'

Browse Source 
Jeongjun Park says:

====================
bpf: fix incorrect name check pass logic in btf_name_valid_section

This patch was written to fix an issue where btf_name_valid_section() would
not properly check names with certain conditions and would throw an OOB vuln.
And selftest was added to verify this patch.
====================

Link: https://lore.kernel.org/r/20240831054525.364353-1-aha310510@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Alexei Starovoitov 2024-09-04 11:56:34 -07:00
commit 5390f315fc
2 changed files with 37 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
kernel/bpf/btf.c
View File

@ -823,9 +823,11 @@ static bool btf_name_valid_section(const struct btf *btf, u32 offset)
const char *src = btf_str_by_offset(btf, offset);
const char *src_limit;
if (!*src)
return false;
/* set a limit on identifier length */
src_limit = src + KSYM_NAME_LEN;
src++;
while (*src && src < src_limit) {
if (!isprint(*src))
return false;

34
tools/testing/selftests/bpf/prog_tests/btf.c
View File

@ -3550,6 +3550,40 @@ static struct btf_raw_test raw_tests[] = {
},
BTF_STR_SEC("\0x\0?.foo bar:buz"),
},
{
.descr = "datasec: name with non-printable first char not is ok",
.raw_types = {
/* int */
BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
/* VAR x */ /* [2] */
BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),
BTF_VAR_STATIC,
/* DATASEC ?.data */ /* [3] */
BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4),
BTF_VAR_SECINFO_ENC(2, 0, 4),
BTF_END_RAW,
},
BTF_STR_SEC("\0x\0\7foo"),
.err_str = "Invalid name",
.btf_load_err = true,
},
{
.descr = "datasec: name '\\0' is not ok",
.raw_types = {
/* int */
BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
/* VAR x */ /* [2] */
BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),
BTF_VAR_STATIC,
/* DATASEC \0 */ /* [3] */
BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4),
BTF_VAR_SECINFO_ENC(2, 0, 4),
BTF_END_RAW,
},
BTF_STR_SEC("\0x\0"),
.err_str = "Invalid name",
.btf_load_err = true,
},
{
.descr = "type name '?foo' is not ok",
.raw_types = {