Commit b831f83e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'bpf-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 

Pull bpf fixes from Alexei Starovoitov:

 - Fix crash when btf_parse_base() returns an error (Martin Lau)

 - Fix out of bounds access in btf_name_valid_section() (Jeongjun Park)

* tag 'bpf-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  selftests/bpf: Add a selftest to check for incorrect names
  bpf: add check for invalid name in btf_name_valid_section()
  bpf: Fix a crash when btf_parse_base() returns an error pointer
parents d759ee24 5390f315

kernel/bpf/btf.c

+4 −2
Original line number Diff line number Diff line
@@ -823,9 +823,11 @@ static bool btf_name_valid_section(const struct btf *btf, u32 offset) 
	const char *src = btf_str_by_offset(btf, offset);

	const char *src_limit;



	if (!*src)

		return false;



	/* set a limit on identifier length */

	src_limit = src + KSYM_NAME_LEN;

	src++;

	while (*src && src < src_limit) {

		if (!isprint(*src))

			return false;
@@ -6283,7 +6285,7 @@ static struct btf *btf_parse_module(const char *module_name, const void *data, 


errout:

	btf_verifier_env_free(env);

	if (base_btf != vmlinux_btf)

	if (!IS_ERR(base_btf) && base_btf != vmlinux_btf)

		btf_free(base_btf);

	if (btf) {

		kvfree(btf->data);

tools/testing/selftests/bpf/prog_tests/btf.c

+34 −0
Original line number Diff line number Diff line
@@ -3550,6 +3550,40 @@ static struct btf_raw_test raw_tests[] = { 
	},

	BTF_STR_SEC("\0x\0?.foo bar:buz"),

},

{

	.descr = "datasec: name with non-printable first char not is ok",

	.raw_types = {

		/* int */

		BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),  /* [1] */

		/* VAR x */                                     /* [2] */

		BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),

		BTF_VAR_STATIC,

		/* DATASEC ?.data */                            /* [3] */

		BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4),

		BTF_VAR_SECINFO_ENC(2, 0, 4),

		BTF_END_RAW,

	},

	BTF_STR_SEC("\0x\0\7foo"),

	.err_str = "Invalid name",

	.btf_load_err = true,

},

{

	.descr = "datasec: name '\\0' is not ok",

	.raw_types = {

		/* int */

		BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),  /* [1] */

		/* VAR x */                                     /* [2] */

		BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),

		BTF_VAR_STATIC,

		/* DATASEC \0 */                                /* [3] */

		BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4),

		BTF_VAR_SECINFO_ENC(2, 0, 4),

		BTF_END_RAW,

	},

	BTF_STR_SEC("\0x\0"),

	.err_str = "Invalid name",

	.btf_load_err = true,

},

{

	.descr = "type name '?foo' is not ok",

	.raw_types = {