diff mbox series

[RESEND,bpf-next,2/2] bpf: sanitize BTF data pointer after module is loaded

Message ID 20201121070829.2612884-2-andrii@kernel.org (mailing list archive)
State Accepted
Commit 607c543f939d8ca6fed7afe90b3a8d6f6684dd17
Delegated to: BPF
Headers show
Series [RESEND,bpf-next,1/2] kbuild: skip module BTF generation for out-of-tree external modules | expand

Checks

Context Check Description
netdev/cover_letter success Link
netdev/fixes_present success Link
netdev/patch_count success Link
netdev/tree_selection success Clearly marked for bpf-next
netdev/subject_prefix success Link
netdev/source_inline success Was 0 now: 0
netdev/verify_signedoff success Link
netdev/module_param success Was 0 now: 0
netdev/build_32bit success Errors and warnings before: 8 this patch: 8
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/verify_fixes success Link
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 11 lines checked
netdev/build_allmodconfig_warn success Errors and warnings before: 8 this patch: 8
netdev/header_inline success Link
netdev/stable success Stable not CCed

Commit Message

Andrii Nakryiko Nov. 21, 2020, 7:08 a.m. UTC
Given .BTF section is not allocatable, it will get trimmed after module is
loaded. BPF system handles that properly by creating an independent copy of
data. But prevent any accidental misused by resetting the pointer to BTF data.

Suggested-by: Jessica Yu <jeyu@kernel.org>
Fixes: 36e68442d1af ("bpf: Load and verify kernel module BTFs")
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---
 kernel/module.c | 5 +++++
 1 file changed, 5 insertions(+)
diff mbox series

Patch

diff --git a/kernel/module.c b/kernel/module.c
index f2996b02ab2e..18f259d61d14 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3709,6 +3709,11 @@  static noinline int do_init_module(struct module *mod)
 	mod->init_layout.ro_size = 0;
 	mod->init_layout.ro_after_init_size = 0;
 	mod->init_layout.text_size = 0;
+#ifdef CONFIG_DEBUG_INFO_BTF_MODULES
+	/* .BTF is not SHF_ALLOC and will get removed, so sanitize pointer */
+	mod->btf_data = NULL;
+	mod->btf_data_size = 0;
+#endif
 	/*
 	 * We want to free module_init, but be aware that kallsyms may be
 	 * walking this with preempt disabled.  In all the failure paths, we