xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bpf: Fix potential array overflow in bpf_trampoline_get_progs()

Browse Source 
commit a2aa95b71c9bbec793b5c5fa50f0a80d882b3e8d upstream.

The cnt value in the 'cnt >= BPF_MAX_TRAMP_PROGS' check does not
include BPF_TRAMP_MODIFY_RETURN bpf programs, so the number of
the attached BPF_TRAMP_MODIFY_RETURN bpf programs in a trampoline
can exceed BPF_MAX_TRAMP_PROGS.

When this happens, the assignment '*progs++ = aux->prog' in
bpf_trampoline_get_progs() will cause progs array overflow as the
progs field in the bpf_tramp_progs struct can only hold at most
BPF_MAX_TRAMP_PROGS bpf programs.

Fixes: 88fd9e5352 ("bpf: Refactor trampoline update code")
Signed-off-by: Yuntao Wang <ytcoode@gmail.com>
Link: https://lore.kernel.org/r/20220430130803.210624-1-ytcoode@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Yuntao Wang
2022-04-30 21:08:03 +08:00
committed by Greg Kroah-Hartman
parent 3097f38e91
commit 7f845de286
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
kernel/bpf/trampoline.c
View File

@@ -378,7 +378,7 @@ int bpf_trampoline_link_prog(struct bpf_prog *prog, struct bpf_trampoline *tr)
{ {
enum bpf_tramp_prog_type kind; enum bpf_tramp_prog_type kind;
int err = 0; int err = 0;
int cnt; int cnt = 0, i;
kind = bpf_attach_type_to_tramp(prog); kind = bpf_attach_type_to_tramp(prog);
mutex_lock(&tr->mutex); mutex_lock(&tr->mutex);
@@ -389,7 +389,10 @@ int bpf_trampoline_link_prog(struct bpf_prog *prog, struct bpf_trampoline *tr)
err = -EBUSY; err = -EBUSY;
goto out; goto out;
} }
cnt = tr->progs_cnt[BPF_TRAMP_FENTRY] + tr->progs_cnt[BPF_TRAMP_FEXIT];
for (i = 0; i < BPF_TRAMP_MAX; i++)
cnt += tr->progs_cnt[i];
if (kind == BPF_TRAMP_REPLACE) { if (kind == BPF_TRAMP_REPLACE) {
/* Cannot attach extension if fentry/fexit are in use. */ /* Cannot attach extension if fentry/fexit are in use. */
if (cnt) { if (cnt) {
@@ -467,16 +470,19 @@ out:
void bpf_trampoline_put(struct bpf_trampoline *tr) void bpf_trampoline_put(struct bpf_trampoline *tr)
{ {
int i;
if (!tr) if (!tr)
return; return;
mutex_lock(&trampoline_mutex); mutex_lock(&trampoline_mutex);
if (!refcount_dec_and_test(&tr->refcnt)) if (!refcount_dec_and_test(&tr->refcnt))
goto out; goto out;
WARN_ON_ONCE(mutex_is_locked(&tr->mutex)); WARN_ON_ONCE(mutex_is_locked(&tr->mutex));
if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[BPF_TRAMP_FENTRY])))
goto out; for (i = 0; i < BPF_TRAMP_MAX; i++)
if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[BPF_TRAMP_FEXIT]))) if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[i])))
goto out; goto out;
/* This code will be executed even when the last bpf_tramp_image /* This code will be executed even when the last bpf_tramp_image
* is alive. All progs are detached from the trampoline and the * is alive. All progs are detached from the trampoline and the
* trampoline image is patched with jmp into epilogue to skip * trampoline image is patched with jmp into epilogue to skip