Commit 3d2786d6 authored by Eduard Zingerman's avatar Eduard Zingerman Committed by Alexei Starovoitov
Browse files

bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos 



In case of malformed relocation record of kind BPF_CORE_TYPE_ID_LOCAL
referencing a non-existing BTF type, function bpf_core_calc_relo_insn
would cause a null pointer deference.

Fix this by adding a proper check upper in call stack, as malformed
relocation records could be passed from user space.

Simplest reproducer is a program:

    r0 = 0
    exit

With a single relocation record:

    .insn_off = 0,          /* patch first instruction */
    .type_id = 100500,      /* this type id does not exist */
    .access_str_off = 6,    /* offset of string "0" */
    .kind = BPF_CORE_TYPE_ID_LOCAL,

See the link for original reproducer or next commit for a test case.

Fixes: 74753e14 ("libbpf: Replace btf__type_by_id() with btf_type_by_id().")
Reported-by: default avatarLiu RuiTong <cnitlrt@gmail.com>
Closes: https://lore.kernel.org/bpf/CAK55_s6do7C+DVwbwY_7nKfUz0YLDoiA1v6X3Y9+p0sWzipFSA@mail.gmail.com/


Acked-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Signed-off-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20240822080124.2995724-2-eddyz87@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent b6ab5090

kernel/bpf/btf.c

+8 −0
Original line number Diff line number Diff line
@@ -8910,6 +8910,7 @@ int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo, 
	struct bpf_core_cand_list cands = {};

	struct bpf_core_relo_res targ_res;

	struct bpf_core_spec *specs;

	const struct btf_type *type;

	int err;



	/* ~4k of temp memory necessary to convert LLVM spec like "0:1:0:5"
@@ -8919,6 +8920,13 @@ int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo, 
	if (!specs)

		return -ENOMEM;



	type = btf_type_by_id(ctx->btf, relo->type_id);

	if (!type) {

		bpf_log(ctx->log, "relo #%u: bad type id %u\n",

			relo_idx, relo->type_id);

		return -EINVAL;

	}



	if (need_cands) {

		struct bpf_cand_cache *cc;

		int i;