Commit 98e527af authored by Andrii Nakryiko's avatar Andrii Nakryiko Committed by Daniel Borkmann

libbpf: Improve handling of corrupted ELF during map initialization

If we get ELF file with "maps" section, but no symbols pointing to it, we'll
end up with division by zero. Add check against this situation and exit early
with error. Found by Coverity scan against Github libbpf sources.

Fixes: bf829271 ("libbpf: refactor map initialization")
Signed-off-by: default avatarAndrii Nakryiko <andriin@fb.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20191107020855.3834758-6-andriin@fb.com
parent 994021a7
...@@ -956,13 +956,13 @@ static int bpf_object__init_user_maps(struct bpf_object *obj, bool strict) ...@@ -956,13 +956,13 @@ static int bpf_object__init_user_maps(struct bpf_object *obj, bool strict)
pr_debug("maps in %s: %d maps in %zd bytes\n", pr_debug("maps in %s: %d maps in %zd bytes\n",
obj->path, nr_maps, data->d_size); obj->path, nr_maps, data->d_size);
map_def_sz = data->d_size / nr_maps; if (!data->d_size || nr_maps == 0 || (data->d_size % nr_maps) != 0) {
if (!data->d_size || (data->d_size % nr_maps) != 0) {
pr_warn("unable to determine map definition size " pr_warn("unable to determine map definition size "
"section %s, %d maps in %zd bytes\n", "section %s, %d maps in %zd bytes\n",
obj->path, nr_maps, data->d_size); obj->path, nr_maps, data->d_size);
return -EINVAL; return -EINVAL;
} }
map_def_sz = data->d_size / nr_maps;
/* Fill obj->maps using data in "maps" section. */ /* Fill obj->maps using data in "maps" section. */
for (i = 0; i < nr_syms; i++) { for (i = 0; i < nr_syms; i++) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment