• Song Liu's avatar
    bpf: Extend BTF_ID_LIST_GLOBAL with parameter for number of IDs · 9e2ad638
    Song Liu authored
    syzbot reported the following BUG w/o CONFIG_DEBUG_INFO_BTF
    
    BUG: KASAN: global-out-of-bounds in task_iter_init+0x212/0x2e7 kernel/bpf/task_iter.c:661
    Read of size 4 at addr ffffffff90297404 by task swapper/0/1
    
    CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.15.0-syzkaller #0
    Hardware name: ... Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
    <TASK>
    __dump_stack lib/dump_stack.c:88 [inline]
    dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
    print_address_description.constprop.0.cold+0xf/0x309 mm/kasan/report.c:256
    __kasan_report mm/kasan/report.c:442 [inline]
    kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
    task_iter_init+0x212/0x2e7 kernel/bpf/task_iter.c:661
    do_one_initcall+0x103/0x650 init/main.c:1295
    do_initcall_level init/main.c:1368 [inline]
    do_initcalls init/main.c:1384 [inline]
    do_basic_setup init/main.c:1403 [inline]
    kernel_init_freeable+0x6b1/0x73a init/main.c:1606
    kernel_init+0x1a/0x1d0 init/main.c:1497
    ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
    </TASK>
    
    This is caused by hard-coded name[1] in BTF_ID_LIST_GLOBAL (w/o
    CONFIG_DEBUG_INFO_BTF). Fix this by adding a parameter n to
    BTF_ID_LIST_GLOBAL. This avoids ifdef CONFIG_DEBUG_INFO_BTF in btf.c and
    filter.c.
    
    Fixes: 7c7e3d31 ("bpf: Introduce helper bpf_find_vma")
    Reported-by: syzbot+e0d81ec552a21d9071aa@syzkaller.appspotmail.com
    Reported-by: default avatarEric Dumazet <edumazet@google.com>
    Suggested-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarSong Liu <songliubraving@fb.com>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Acked-by: default avatarYonghong Song <yhs@fb.com>
    Link: https://lore.kernel.org/bpf/20211112150243.1270987-2-songliubraving@fb.com
    9e2ad638
btf.c 164 KB