* [PATCH bpf] libbpf: fix overflow in BTF sanity checks
@ 2021-10-19 16:58 andrii.nakryiko
2021-10-21 1:14 ` Alexei Starovoitov
0 siblings, 1 reply; 2+ messages in thread
From: andrii.nakryiko @ 2021-10-19 16:58 UTC (permalink / raw)
To: bpf, ast, daniel; +Cc: andrii, kernel-team, Evgeny Vereshchagin
From: Andrii Nakryiko <andrii@kernel.org>
btf_header's str_off+str_len or type_off+type_len can overflow as they
are u32s. This will lead to bypassing the sanity checks during BTF
parsing, resulting in crashes afterwards. Fix by using 64-bit signed
integers for comparison.
Fixes: d8123624506c ("libbpf: Fix BTF data layout checks and allow empty BTF")
Reported-by: Evgeny Vereshchagin <evvers@ya.ru>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---
tools/lib/bpf/btf.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 1f6dea11f600..7ed117401e52 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -241,12 +241,12 @@ static int btf_parse_hdr(struct btf *btf)
}
meta_left = btf->raw_size - sizeof(*hdr);
- if (meta_left < hdr->str_off + hdr->str_len) {
+ if (meta_left < (long long)hdr->str_off + hdr->str_len) {
pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
return -EINVAL;
}
- if (hdr->type_off + hdr->type_len > hdr->str_off) {
+ if ((long long)hdr->type_off + hdr->type_len > hdr->str_off) {
pr_debug("Invalid BTF data sections layout: type data at %u + %u, strings data at %u + %u\n",
hdr->type_off, hdr->type_len, hdr->str_off, hdr->str_len);
return -EINVAL;
--
2.30.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH bpf] libbpf: fix overflow in BTF sanity checks
2021-10-19 16:58 [PATCH bpf] libbpf: fix overflow in BTF sanity checks andrii.nakryiko
@ 2021-10-21 1:14 ` Alexei Starovoitov
0 siblings, 0 replies; 2+ messages in thread
From: Alexei Starovoitov @ 2021-10-21 1:14 UTC (permalink / raw)
To: Andrii Nakryiko
Cc: bpf, Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Kernel Team, Evgeny Vereshchagin
On Tue, Oct 19, 2021 at 9:58 AM <andrii.nakryiko@gmail.com> wrote:
>
> From: Andrii Nakryiko <andrii@kernel.org>
>
> btf_header's str_off+str_len or type_off+type_len can overflow as they
> are u32s. This will lead to bypassing the sanity checks during BTF
> parsing, resulting in crashes afterwards. Fix by using 64-bit signed
> integers for comparison.
>
> Fixes: d8123624506c ("libbpf: Fix BTF data layout checks and allow empty BTF")
> Reported-by: Evgeny Vereshchagin <evvers@ya.ru>
> Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-10-21 1:15 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-19 16:58 [PATCH bpf] libbpf: fix overflow in BTF sanity checks andrii.nakryiko
2021-10-21 1:14 ` Alexei Starovoitov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).