Skip to content

Commit 5390f31

Browse files
author
Alexei Starovoitov
committed
Merge branch 'bpf-fix-incorrect-name-check-pass-logic-in-btf_name_valid_section'
Jeongjun Park says: ==================== bpf: fix incorrect name check pass logic in btf_name_valid_section This patch was written to fix an issue where btf_name_valid_section() would not properly check names with certain conditions and would throw an OOB vuln. And selftest was added to verify this patch. ==================== Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Alexei Starovoitov <[email protected]>
2 parents b408473 + 7430708 commit 5390f31

File tree

2 files changed

+37
-1
lines changed
  • kernel/bpf
  • tools/testing/selftests/bpf/prog_tests

2 files changed

+37
-1
lines changed

kernel/bpf/btf.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -823,9 +823,11 @@ static bool btf_name_valid_section(const struct btf *btf, u32 offset)
823823
const char *src = btf_str_by_offset(btf, offset);
824824
const char *src_limit;
825825

826+
if (!*src)
827+
return false;
828+
826829
/* set a limit on identifier length */
827830
src_limit = src + KSYM_NAME_LEN;
828-
src++;
829831
while (*src && src < src_limit) {
830832
if (!isprint(*src))
831833
return false;

tools/testing/selftests/bpf/prog_tests/btf.c

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3550,6 +3550,40 @@ static struct btf_raw_test raw_tests[] = {
35503550
},
35513551
BTF_STR_SEC("\0x\0?.foo bar:buz"),
35523552
},
3553+
{
3554+
.descr = "datasec: name with non-printable first char not is ok",
3555+
.raw_types = {
3556+
/* int */
3557+
BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
3558+
/* VAR x */ /* [2] */
3559+
BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),
3560+
BTF_VAR_STATIC,
3561+
/* DATASEC ?.data */ /* [3] */
3562+
BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4),
3563+
BTF_VAR_SECINFO_ENC(2, 0, 4),
3564+
BTF_END_RAW,
3565+
},
3566+
BTF_STR_SEC("\0x\0\7foo"),
3567+
.err_str = "Invalid name",
3568+
.btf_load_err = true,
3569+
},
3570+
{
3571+
.descr = "datasec: name '\\0' is not ok",
3572+
.raw_types = {
3573+
/* int */
3574+
BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
3575+
/* VAR x */ /* [2] */
3576+
BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),
3577+
BTF_VAR_STATIC,
3578+
/* DATASEC \0 */ /* [3] */
3579+
BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4),
3580+
BTF_VAR_SECINFO_ENC(2, 0, 4),
3581+
BTF_END_RAW,
3582+
},
3583+
BTF_STR_SEC("\0x\0"),
3584+
.err_str = "Invalid name",
3585+
.btf_load_err = true,
3586+
},
35533587
{
35543588
.descr = "type name '?foo' is not ok",
35553589
.raw_types = {

0 commit comments

Comments
 (0)