Commit 5390f315 authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'bpf-fix-incorrect-name-check-pass-logic-in-btf_name_valid_section' 

Jeongjun Park says:

====================
bpf: fix incorrect name check pass logic in btf_name_valid_section

This patch was written to fix an issue where btf_name_valid_section() would
not properly check names with certain conditions and would throw an OOB vuln.
And selftest was added to verify this patch.
====================

Link: https://lore.kernel.org/r/20240831054525.364353-1-aha310510@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents b408473e 74307089

kernel/bpf/btf.c

+3 −1
Original line number Diff line number Diff line
@@ -823,9 +823,11 @@ static bool btf_name_valid_section(const struct btf *btf, u32 offset) 
	const char *src = btf_str_by_offset(btf, offset);

	const char *src_limit;



	if (!*src)

		return false;



	/* set a limit on identifier length */

	src_limit = src + KSYM_NAME_LEN;

	src++;

	while (*src && src < src_limit) {

		if (!isprint(*src))

			return false;

tools/testing/selftests/bpf/prog_tests/btf.c

+34 −0
Original line number Diff line number Diff line
@@ -3550,6 +3550,40 @@ static struct btf_raw_test raw_tests[] = { 
	},

	BTF_STR_SEC("\0x\0?.foo bar:buz"),

},

{

	.descr = "datasec: name with non-printable first char not is ok",

	.raw_types = {

		/* int */

		BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),  /* [1] */

		/* VAR x */                                     /* [2] */

		BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),

		BTF_VAR_STATIC,

		/* DATASEC ?.data */                            /* [3] */

		BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4),

		BTF_VAR_SECINFO_ENC(2, 0, 4),

		BTF_END_RAW,

	},

	BTF_STR_SEC("\0x\0\7foo"),

	.err_str = "Invalid name",

	.btf_load_err = true,

},

{

	.descr = "datasec: name '\\0' is not ok",

	.raw_types = {

		/* int */

		BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),  /* [1] */

		/* VAR x */                                     /* [2] */

		BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),

		BTF_VAR_STATIC,

		/* DATASEC \0 */                                /* [3] */

		BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4),

		BTF_VAR_SECINFO_ENC(2, 0, 4),

		BTF_END_RAW,

	},

	BTF_STR_SEC("\0x\0"),

	.err_str = "Invalid name",

	.btf_load_err = true,

},

{

	.descr = "type name '?foo' is not ok",

	.raw_types = {