Skip to content

Commit bb6705c

Browse files
name2965Alexei Starovoitov
authored andcommitted
bpf: add check for invalid name in btf_name_valid_section()
If the length of the name string is 1 and the value of name[0] is NULL byte, an OOB vulnerability occurs in btf_name_valid_section() and the return value is true, so the invalid name passes the check. To solve this, you need to check if the first position is NULL byte and if the first character is printable. Suggested-by: Eduard Zingerman <[email protected]> Fixes: bd70a8f ("bpf: Allow all printable characters in BTF DATASEC names") Signed-off-by: Jeongjun Park <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Alexei Starovoitov <[email protected]> Acked-by: Eduard Zingerman <[email protected]>
1 parent b408473 commit bb6705c

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

kernel/bpf/btf.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -823,9 +823,11 @@ static bool btf_name_valid_section(const struct btf *btf, u32 offset)
823823
const char *src = btf_str_by_offset(btf, offset);
824824
const char *src_limit;
825825

826+
if (!*src)
827+
return false;
828+
826829
/* set a limit on identifier length */
827830
src_limit = src + KSYM_NAME_LEN;
828-
src++;
829831
while (*src && src < src_limit) {
830832
if (!isprint(*src))
831833
return false;

0 commit comments

Comments
 (0)