shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 02:50:49 +09:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'libbpf: fix fuzzer-reported issues'

Browse Source 
Shung-Hsi Yu says:

====================

Hi, this patch set fixes several fuzzer-reported issues of libbpf when
dealing with (malformed) BPF object file:

- patch #1 fix out-of-bound heap write reported by oss-fuzz (currently
  incorrectly marked as fixed)

- patch #2 and #3 fix null-pointer dereference found by locally-run
  fuzzer.

v2:
- Rebase to bpf-next
- Move elf_getshdrnum() closer to where it's result is used in patch #1, as
  suggested by Andrii
  - Touch up the comment in bpf_object__elf_collect(), replacing mention of
    e_shnum with elf_getshdrnum()
- Minor wording change in commit message of patch #1 to for better readability
- Remove extra note that comes after commit message in patch #1

v1: https://lore.kernel.org/bpf/20221007174816.17536-1-shung-hsi.yu@suse.com/
====================

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
This commit is contained in:
Andrii Nakryiko
2022-10-13 08:50:08 -07:00
parent 6e73e683b6 d0d382f95a
commit e94e0a2d37
1 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
tools/lib/bpf/libbpf.c
View File

@@ -597,7 +597,7 @@ struct elf_state {
size_t shstrndx; /* section index for section name strings */
size_t strtabidx;
struct elf_sec_desc *secs;
int sec_cnt;
size_t sec_cnt;
int btf_maps_shndx;
__u32 btf_maps_sec_btf_id;
int text_shndx;
@@ -1408,6 +1408,10 @@ static int bpf_object__check_endianness(struct bpf_object *obj)
static int
bpf_object__init_license(struct bpf_object *obj, void *data, size_t size)
{
if (!data) {
pr_warn("invalid license section in %s\n", obj->path);
return -LIBBPF_ERRNO__FORMAT;
}
/* libbpf_strlcpy() only copies first N - 1 bytes, so size + 1 won't
* go over allowed ELF data section buffer
*/
@@ -1421,7 +1425,7 @@ bpf_object__init_kversion(struct bpf_object *obj, void *data, size_t size)
{
__u32 kver;
if (size != sizeof(kver)) {
if (!data || size != sizeof(kver)) {
pr_warn("invalid kver section in %s\n", obj->path);
return -LIBBPF_ERRNO__FORMAT;
}
@@ -3312,10 +3316,15 @@ static int bpf_object__elf_collect(struct bpf_object *obj)
Elf64_Shdr *sh;
/* ELF section indices are 0-based, but sec #0 is special "invalid"
* section. e_shnum does include sec #0, so e_shnum is the necessary
* size of an array to keep all the sections.
* section. Since section count retrieved by elf_getshdrnum() does
* include sec #0, it is already the necessary size of an array to keep
* all the sections.
*/
obj->efile.sec_cnt = obj->efile.ehdr->e_shnum;
if (elf_getshdrnum(obj->efile.elf, &obj->efile.sec_cnt)) {
pr_warn("elf: failed to get the number of sections for %s: %s\n",
obj->path, elf_errmsg(-1));
return -LIBBPF_ERRNO__FORMAT;
}
obj->efile.secs = calloc(obj->efile.sec_cnt, sizeof(*obj->efile.secs));
if (!obj->efile.secs)
return -ENOMEM;
@@ -4106,6 +4115,9 @@ static struct bpf_program *find_prog_by_sec_insn(const struct bpf_object *obj,
int l = 0, r = obj->nr_programs - 1, m;
struct bpf_program *prog;
if (!obj->nr_programs)
return NULL;
while (l < r) {
m = l + (r - l + 1) / 2;
prog = &obj->programs[m];