Commit 607c543f authored by Andrii Nakryiko's avatar Andrii Nakryiko Committed by Daniel Borkmann

bpf: Sanitize BTF data pointer after module is loaded

Given .BTF section is not allocatable, it will get trimmed after module is
loaded. BPF system handles that properly by creating an independent copy of
data. But prevent any accidental misused by resetting the pointer to BTF data.

Fixes: 36e68442 ("bpf: Load and verify kernel module BTFs")
Suggested-by: default avatarJessica Yu <jeyu@kernel.org>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarJessica Yu <jeyu@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/bpf/20201121070829.2612884-2-andrii@kernel.org
parent e732b538
...@@ -3709,6 +3709,11 @@ static noinline int do_init_module(struct module *mod) ...@@ -3709,6 +3709,11 @@ static noinline int do_init_module(struct module *mod)
mod->init_layout.ro_size = 0; mod->init_layout.ro_size = 0;
mod->init_layout.ro_after_init_size = 0; mod->init_layout.ro_after_init_size = 0;
mod->init_layout.text_size = 0; mod->init_layout.text_size = 0;
#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
/* .BTF is not SHF_ALLOC and will get removed, so sanitize pointer */
mod->btf_data = NULL;
mod->btf_data_size = 0;
#endif
/* /*
* We want to free module_init, but be aware that kallsyms may be * We want to free module_init, but be aware that kallsyms may be
* walking this with preempt disabled. In all the failure paths, we * walking this with preempt disabled. In all the failure paths, we
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment