f9b74ef61f
Signed-off-by: zhang-mingyi66 <zhangmingyi5@huawei.com> (cherry picked from commit df1994dbe800177b3b184a607e9634d19e0d3b23)
104 lines
3.8 KiB
Diff
104 lines
3.8 KiB
Diff
From 7b5237996a42c3b8a6fe8ccae656047de2831f58 Mon Sep 17 00:00:00 2001
|
|
From: David Vernet <void@manifault.com>
|
|
Date: Wed, 24 Jul 2024 12:14:58 -0500
|
|
Subject: [PATCH] libbpf: Don't take direct pointers into BTF data from st_ops
|
|
|
|
In struct bpf_struct_ops, we have take a pointer to a BTF type name, and
|
|
a struct btf_type. This was presumably done for convenience, but can
|
|
actually result in subtle and confusing bugs given that BTF data can be
|
|
invalidated before a program is loaded. For example, in sched_ext, we
|
|
may sometimes resize a data section after a skeleton has been opened,
|
|
but before the struct_ops scheduler map has been loaded. This may cause
|
|
the BTF data to be realloc'd, which can then cause a UAF when loading
|
|
the program because the struct_ops map has pointers directly into the
|
|
BTF data.
|
|
|
|
We're already storing the BTF type_id in struct bpf_struct_ops. Because
|
|
type_id is stable, we can therefore just update the places where we were
|
|
looking at those pointers to instead do the lookups we need from the
|
|
type_id.
|
|
|
|
Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support")
|
|
Signed-off-by: David Vernet <void@manifault.com>
|
|
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
|
|
Link: https://lore.kernel.org/bpf/20240724171459.281234-1-void@manifault.com
|
|
---
|
|
src/libbpf.c | 19 +++++++++---------
|
|
1 file changed, 9 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/src/libbpf.c b/src/libbpf.c
|
|
index a3be6f8fa..e55353887 100644
|
|
--- a/src/libbpf.c
|
|
+++ b/src/libbpf.c
|
|
@@ -496,8 +496,6 @@ struct bpf_program {
|
|
};
|
|
|
|
struct bpf_struct_ops {
|
|
- const char *tname;
|
|
- const struct btf_type *type;
|
|
struct bpf_program **progs;
|
|
__u32 *kern_func_off;
|
|
/* e.g. struct tcp_congestion_ops in bpf_prog's btf format */
|
|
@@ -1121,8 +1122,8 @@ static int bpf_map__init_kern_struct_ops(struct bpf_map *map)
|
|
int err;
|
|
|
|
st_ops = map->st_ops;
|
|
- type = st_ops->type;
|
|
- tname = st_ops->tname;
|
|
+ type = btf__type_by_id(btf, st_ops->type_id);
|
|
+ tname = btf__name_by_offset(btf, type->name_off);
|
|
err = find_struct_ops_kern_types(kern_btf, tname,
|
|
&kern_type, &kern_type_id,
|
|
&kern_vtype, &kern_vtype_id,
|
|
@@ -1423,8 +1424,6 @@ static int init_struct_ops_maps(struct bpf_object *obj, const char *sec_name,
|
|
memcpy(st_ops->data,
|
|
data->d_buf + vsi->offset,
|
|
type->size);
|
|
- st_ops->tname = tname;
|
|
- st_ops->type = type;
|
|
st_ops->type_id = type_id;
|
|
|
|
pr_debug("struct_ops init: struct %s(type_id=%u) %s found at offset %u\n",
|
|
@@ -8445,11 +8444,13 @@ static int bpf_object__resolve_externs(struct bpf_object *obj,
|
|
|
|
static void bpf_map_prepare_vdata(const struct bpf_map *map)
|
|
{
|
|
+ const struct btf_type *type;
|
|
struct bpf_struct_ops *st_ops;
|
|
__u32 i;
|
|
|
|
st_ops = map->st_ops;
|
|
- for (i = 0; i < btf_vlen(st_ops->type); i++) {
|
|
+ type = btf__type_by_id(map->obj->btf, st_ops->type_id);
|
|
+ for (i = 0; i < btf_vlen(type); i++) {
|
|
struct bpf_program *prog = st_ops->progs[i];
|
|
void *kern_data;
|
|
int prog_fd;
|
|
@@ -9712,6 +9713,7 @@ static struct bpf_map *find_struct_ops_map_by_offset(struct bpf_object *obj,
|
|
static int bpf_object__collect_st_ops_relos(struct bpf_object *obj,
|
|
Elf64_Shdr *shdr, Elf_Data *data)
|
|
{
|
|
+ const struct btf_type *type;
|
|
const struct btf_member *member;
|
|
struct bpf_struct_ops *st_ops;
|
|
struct bpf_program *prog;
|
|
@@ -9771,13 +9773,14 @@ static int bpf_object__collect_st_ops_relos(struct bpf_object *obj,
|
|
}
|
|
insn_idx = sym->st_value / BPF_INSN_SZ;
|
|
|
|
- member = find_member_by_offset(st_ops->type, moff * 8);
|
|
+ type = btf__type_by_id(btf, st_ops->type_id);
|
|
+ member = find_member_by_offset(type, moff * 8);
|
|
if (!member) {
|
|
pr_warn("struct_ops reloc %s: cannot find member at moff %u\n",
|
|
map->name, moff);
|
|
return -EINVAL;
|
|
}
|
|
- member_idx = member - btf_members(st_ops->type);
|
|
+ member_idx = member - btf_members(type);
|
|
name = btf__name_by_offset(btf, member->name_off);
|
|
|
|
if (!resolve_func_ptr(btf, member->type, NULL)) {
|
|
--
|
|
2.23.0
|