* [PATCH bpf] bpf: Limit maximum modifier chain length in btf_check_type_tags
@ 2022-06-15 4:21 Kumar Kartikeya Dwivedi
2022-06-15 15:35 ` Yonghong Song
2022-06-15 17:40 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Kumar Kartikeya Dwivedi @ 2022-06-15 4:21 UTC (permalink / raw)
To: bpf; +Cc: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann
On processing a module BTF of module built for an older kernel, we might
sometimes find that some type points to itself forming a loop. If such a
type is a modifier, btf_check_type_tags's while loop following modifier
chain will be caught in an infinite loop.
Fix this by defining a maximum chain length and bailing out if we spin
any longer than that.
Fixes: eb596b090558 ("bpf: Ensure type tags precede modifiers in BTF")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
kernel/bpf/btf.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 63d0ac7dfe2f..eb12d4f705cc 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -4815,6 +4815,7 @@ static int btf_check_type_tags(struct btf_verifier_env *env,
n = btf_nr_types(btf);
for (i = start_id; i < n; i++) {
const struct btf_type *t;
+ int chain_limit = 32;
u32 cur_id = i;
t = btf_type_by_id(btf, i);
@@ -4827,6 +4828,10 @@ static int btf_check_type_tags(struct btf_verifier_env *env,
in_tags = btf_type_is_type_tag(t);
while (btf_type_is_modifier(t)) {
+ if (!chain_limit--) {
+ btf_verifier_log(env, "Max chain length or cycle detected");
+ return -ELOOP;
+ }
if (btf_type_is_type_tag(t)) {
if (!in_tags) {
btf_verifier_log(env, "Type tags don't precede modifiers");
--
2.36.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH bpf] bpf: Limit maximum modifier chain length in btf_check_type_tags
2022-06-15 4:21 [PATCH bpf] bpf: Limit maximum modifier chain length in btf_check_type_tags Kumar Kartikeya Dwivedi
@ 2022-06-15 15:35 ` Yonghong Song
2022-06-15 17:40 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Yonghong Song @ 2022-06-15 15:35 UTC (permalink / raw)
To: Kumar Kartikeya Dwivedi, bpf
Cc: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann
On 6/14/22 9:21 PM, Kumar Kartikeya Dwivedi wrote:
> !-------------------------------------------------------------------|
> This Message Is From an External Sender
> This message came from outside your organization.
> |-------------------------------------------------------------------!
>
> On processing a module BTF of module built for an older kernel, we might
> sometimes find that some type points to itself forming a loop. If such a
> type is a modifier, btf_check_type_tags's while loop following modifier
> chain will be caught in an infinite loop.
>
> Fix this by defining a maximum chain length and bailing out if we spin
> any longer than that.
>
> Fixes: eb596b090558 ("bpf: Ensure type tags precede modifiers in BTF")
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Yonghong Song <yhs@fb.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH bpf] bpf: Limit maximum modifier chain length in btf_check_type_tags
2022-06-15 4:21 [PATCH bpf] bpf: Limit maximum modifier chain length in btf_check_type_tags Kumar Kartikeya Dwivedi
2022-06-15 15:35 ` Yonghong Song
@ 2022-06-15 17:40 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-06-15 17:40 UTC (permalink / raw)
To: Kumar Kartikeya Dwivedi; +Cc: bpf, ast, andrii, daniel
Hello:
This patch was applied to bpf/bpf.git (master)
by Daniel Borkmann <daniel@iogearbox.net>:
On Wed, 15 Jun 2022 09:51:51 +0530 you wrote:
> On processing a module BTF of module built for an older kernel, we might
> sometimes find that some type points to itself forming a loop. If such a
> type is a modifier, btf_check_type_tags's while loop following modifier
> chain will be caught in an infinite loop.
>
> Fix this by defining a maximum chain length and bailing out if we spin
> any longer than that.
>
> [...]
Here is the summary with links:
- [bpf] bpf: Limit maximum modifier chain length in btf_check_type_tags
https://git.kernel.org/bpf/bpf/c/d1a374a1aeb7
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-06-15 17:40 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-15 4:21 [PATCH bpf] bpf: Limit maximum modifier chain length in btf_check_type_tags Kumar Kartikeya Dwivedi
2022-06-15 15:35 ` Yonghong Song
2022-06-15 17:40 ` patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.