Commit 5390f315 authored by Alexei Starovoitov's avatar Alexei Starovoitov

Merge branch 'bpf-fix-incorrect-name-check-pass-logic-in-btf_name_valid_section'

Jeongjun Park says:

====================
bpf: fix incorrect name check pass logic in btf_name_valid_section

This patch was written to fix an issue where btf_name_valid_section() would
not properly check names with certain conditions and would throw an OOB vuln.
And selftest was added to verify this patch.
====================

Link: https://lore.kernel.org/r/20240831054525.364353-1-aha310510@gmail.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents b408473e 74307089
......@@ -823,9 +823,11 @@ static bool btf_name_valid_section(const struct btf *btf, u32 offset)
const char *src = btf_str_by_offset(btf, offset);
const char *src_limit;
if (!*src)
return false;
/* set a limit on identifier length */
src_limit = src + KSYM_NAME_LEN;
src++;
while (*src && src < src_limit) {
if (!isprint(*src))
return false;
......
......@@ -3550,6 +3550,40 @@ static struct btf_raw_test raw_tests[] = {
},
BTF_STR_SEC("\0x\0?.foo bar:buz"),
},
{
.descr = "datasec: name with non-printable first char not is ok",
.raw_types = {
/* int */
BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
/* VAR x */ /* [2] */
BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),
BTF_VAR_STATIC,
/* DATASEC ?.data */ /* [3] */
BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4),
BTF_VAR_SECINFO_ENC(2, 0, 4),
BTF_END_RAW,
},
BTF_STR_SEC("\0x\0\7foo"),
.err_str = "Invalid name",
.btf_load_err = true,
},
{
.descr = "datasec: name '\\0' is not ok",
.raw_types = {
/* int */
BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
/* VAR x */ /* [2] */
BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),
BTF_VAR_STATIC,
/* DATASEC \0 */ /* [3] */
BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4),
BTF_VAR_SECINFO_ENC(2, 0, 4),
BTF_END_RAW,
},
BTF_STR_SEC("\0x\0"),
.err_str = "Invalid name",
.btf_load_err = true,
},
{
.descr = "type name '?foo' is not ok",
.raw_types = {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment