From patchwork Sat Aug 31 05:47:02 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeongjun Park X-Patchwork-Id: 13785938 X-Patchwork-Delegate: bpf@iogearbox.net Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 325963C30; Sat, 31 Aug 2024 05:47:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725083239; cv=none; b=iDN6a9jImxWyhRhF8DSCCbfDI1UPrdco6UVOU0askL4nDSgd8buEIra38Ls9LNHL5QqdLtO9DlQralcsrz/LG3rMlVXNLWFk/zLIXtVC8+JImt7BHM5Y+8Kz7c48FRgOsst4fcahsiNgCYO+avWk0RbNVjHQ9XCQmLDu9CbqWeE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725083239; c=relaxed/simple; bh=u8imtR1wqjX5vtSYhiGWTIpQ9iFad42AOyF4T1X0eQ8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=USXwITDWRMLndlbVqVcsuMoh4XSLPUTpGTy6SU4uxz8NNG/peQNZ2i74x7lffEKp5TFlX2TY7e3QbeMvzijDxyVDCigoNDS7OVg61YRi9Nf38hMqOdk7Lr2aZDNMhfhrZsnqg8D0ED2erQlfHnjmPukK97ozfQul5dRIxYjq29g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=OPeg55X9; arc=none smtp.client-ip=209.85.216.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="OPeg55X9" Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-2d86f71353dso929455a91.2; Fri, 30 Aug 2024 22:47:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1725083237; x=1725688037; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=M3qdCv/34SlaBM7I6zxUMTcENRlUyUZdBcHJE/PR9fU=; b=OPeg55X98vnQkweC5R3CM3dan8GEjnib8lJgUvNpRz4/LtNNvEGIWUqv5m2mragH68 /J+5BTo5FqkPzHluzrRYMbqvnCrb7u8DwGk9UJxCnXF03mBHhvkst5zfUg/RyNYU7hXz pgjdWDGFgHS6a7ugruYy0+mfVSxxUYxkXfF+ytNnFPw2Uq9J1fHj7NxEF65hWRtY0J1S MiHihbl/8FJYL0jxGmlkK4bGU5uPPrUmNWCiBjEUpJp9dg8sJgs/wOQOQgCv7tQOVCx5 rWrfROvhSH7p0EvSMeKcBmk1jEJahoQ2lgVsUybI33uzrIH7hN3D8G6QqSu8EWW7vpTZ qI7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1725083237; x=1725688037; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=M3qdCv/34SlaBM7I6zxUMTcENRlUyUZdBcHJE/PR9fU=; b=WRJcvaZKS1CtKcFw4J0R9WZMZ8ImC9qAIp66JR1C/lPOWSVMdQYy5YlQ1eDp3is4Vk F1icB1FymIPVwHnTBfRENvfRPi6w8Ddn6dfc/Pcqj3WDANdxT0p4YnZwfewxHJSBfOMr wRopw3AxkDj4iKr7Xr9cFng6SPLqEkZAjFAvhdIysK+lOxXGbHzm6KHdvUFLzJkbvDwO znqHN52B+bX7m6P+wYXEnZZnoFv9We5+boa3QzkRn5BMeK7G5x0mGlFdbky0EKHl5boQ u1MN4wz1/ZBfyBGDfbfRO6w2wHOgaXM5dTVWhjKmfcitK/U1dnnp815JmiuO1XRMc6yh 6Yqg== X-Forwarded-Encrypted: i=1; AJvYcCULhMP/jamvKQF01sAPX5JDk5HrShYmWcLJGbpVYQS1tdJsyh50hupIDH2M1ri432UmbW2h+RTwOb0pPuNW@vger.kernel.org, AJvYcCVEecsTiTbQPu+dWZiSZD154sDWnF1UTj0iOa3okWDS2BsMSMv2c82ExaK2e3ljWPpqLa36zAEs8Rq9ovpzelLC@vger.kernel.org, AJvYcCXC9y2vHFm8nXdDQXoOhdakqBDUUdhGQGyP+ycVscIhz0SkLX8V83cqJgIE7V+D4/eMbMc=@vger.kernel.org X-Gm-Message-State: AOJu0Yxw3nkT/g7Qt8GaBZAKpjd4EWRGIxSw3+9g/qTlyV5wFdb91xgm m8lIm/6UgeekkKHpZO15ch9+3w7rIBCWXj1BiFIRMPlWmkIRX3lM X-Google-Smtp-Source: AGHT+IHXwInMq6af8y1ipsdH1bz4MMYFrRFxEv5rCJC6uklQHBzukPu6RFf949bPS/zf1NsivGruXw== X-Received: by 2002:a17:90a:1090:b0:2c2:deda:8561 with SMTP id 98e67ed59e1d1-2d8564b146fmr8448470a91.41.1725083237325; Fri, 30 Aug 2024 22:47:17 -0700 (PDT) Received: from kernelexploit-virtual-machine.localdomain ([121.185.186.233]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-2d89b12f585sm430713a91.41.2024.08.30.22.47.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Aug 2024 22:47:17 -0700 (PDT) From: Jeongjun Park To: martin.lau@linux.dev, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com Cc: song@kernel.org, yonghong.song@linux.dev, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org, mykolal@fb.com, shuah@kernel.org, aha310510@gmail.com, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf,v2,1/2] bpf: add check for invalid name in btf_name_valid_section() Date: Sat, 31 Aug 2024 14:47:02 +0900 Message-Id: <20240831054702.364455-1-aha310510@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240831054525.364353-1-aha310510@gmail.com> References: <20240831054525.364353-1-aha310510@gmail.com> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: bpf@iogearbox.net If the length of the name string is 1 and the value of name[0] is NULL byte, an OOB vulnerability occurs in btf_name_valid_section() and the return value is true, so the invalid name passes the check. To solve this, you need to check if the first position is NULL byte and if the first character is printable. Suggested-by: Eduard Zingerman Fixes: bd70a8fb7ca4 ("bpf: Allow all printable characters in BTF DATASEC names") Signed-off-by: Jeongjun Park --- kernel/bpf/btf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 520f49f422fe..f1e91bf367fa 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -823,9 +823,11 @@ static bool btf_name_valid_section(const struct btf *btf, u32 offset) const char *src = btf_str_by_offset(btf, offset); const char *src_limit; + if (!*src) + return false; + /* set a limit on identifier length */ src_limit = src + KSYM_NAME_LEN; - src++; while (*src && src < src_limit) { if (!isprint(*src)) return false; From patchwork Sat Aug 31 05:47:42 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeongjun Park X-Patchwork-Id: 13785940 X-Patchwork-Delegate: bpf@iogearbox.net Received: from mail-pf1-f174.google.com (mail-pf1-f174.google.com [209.85.210.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2AFBA2E405; Sat, 31 Aug 2024 05:47:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725083271; cv=none; b=p5kkgDgnipu/DRtjkBdvj8tSgKEir476aXheJR2bAYG143z1hTEFiBeakahqEg7TMUF9JgdC0DsjAvfAl8vA0iddm4opkzxgdP2qcfcIj0drCDc0y7X9+sWnCTxn53IIMMds9x4ekO+1GWpIqRVow7hv1j12oAgWHirFz/gr9Eo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725083271; c=relaxed/simple; bh=cV8GigBqJzTIQ/oFjGK4Y5hHeBbGDREvYmt5NzuQCEU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=a8c7DBqX+3a7KbXJ5P3u/9x110464tV0hbVrfU9/3XOoQtxAXzNYl0eP0SnQMM8C43Y66G6TQ0FJcvpZCzgSG814YmUU0skt4YScPRK54Y/nPO4ez2F+cUSXJ/xt3m1knbSP5qNNdksZmdyQCXT6Yt04f90yaUgIaHjHDdiidjk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XRNzVlSr; arc=none smtp.client-ip=209.85.210.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XRNzVlSr" Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-71744362c22so43981b3a.2; Fri, 30 Aug 2024 22:47:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1725083269; x=1725688069; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=4ckgtpxhKEUT5nAj96jMRuGhhWodTxLNrAvXaIKOqCk=; b=XRNzVlSrqWc2RoP0C0WlpBt7P/lAxyJXnrsBR3zWy3eVXAuQWqon0vlj6OlBWVzVUg 23beQa4ADGOrOZ9fn36mxXY0tQssXaO7yCDqoDFrUjp6WaRNsIF3xrHlCAdbgtgC+QGx 0MEyi8VLStzuYIoSZzSN4aUOKkjNlzcaO4S+F0AuRDcAb0NoaVFhQHV2CNNG5XqZ0wZw DH2ycOejZdwQtHt36kJn9TcWJcvUxM3KMoXVXQ3PyW0FhguHrHxEpTuxXni9ngr2lYM+ 5eeeqQtPxB2RhI4bjZLIAZs+Gkd/3t8RjdP1kF25821fySreVNm4aPHwKrlcacUsXFja sEow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1725083269; x=1725688069; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=4ckgtpxhKEUT5nAj96jMRuGhhWodTxLNrAvXaIKOqCk=; b=jer/iUCoGlu7KzRwnYAIq3ttmwRgMHHzZIlpbI+xR82i+M8qNDF8XvcBVlYKXbnUqz WjqRNMZKpYnCQtN1cUrz2MiQkAC2wc+4m7oRY8ChDILf/joW6D7lljTs2WmVluO9yAEt zCowaoAKnCciwzQRGU75VeBPV9ZhewcUIejMzRMftoRdEAJU+9P34DFNLdHj4Nbq8ET/ gwQI6o6j6VcQfAh6eSeM9lLTMyvEoikztrt1fFDHuV6NnMifY5XQQhEkqwgM2R7ztNwg 781XVSdP8C2cNdVMd4eB6z3egN2zyiyNzXJ7M5uXXZDZQWV/dUQtNeTY//aIn5DDpZK4 EyTg== X-Forwarded-Encrypted: i=1; AJvYcCV0BCTqxaJf6YP2ojUTyvwh9TLzNwbPGpFbg37r+NbEpEf09GOv4KxAS/sV3XyAFs3cmB2s9XE7cHnyhgXCvdj4@vger.kernel.org, AJvYcCWImEreNJgtmG0OVtLYdTI0Z90GwjN/hBrNgA3QdZkiJOFURS58EfcHv7WZJuFMOZRt/hYe2yytu6dbaXbJ@vger.kernel.org, AJvYcCWK+oVMifu0+5FivpPQzLWfmk8/chYn0r4621IO5wnD4hqOpOe0PArztGvwwvflStcHGZ8=@vger.kernel.org X-Gm-Message-State: AOJu0YyTQWX+gs1XVw+oAceW0eo7JVAWO1NNqZcltC+5hvXrJfv9EjmZ L12SrWzdBgVxBYwOMh42oh2amYl8E2eK6VgUMM5uogZdnLVWPzPM X-Google-Smtp-Source: AGHT+IG/WCbMFojSxC3xOhkFsA9bL6w0IdupUHCplkiRyaZ3b3v1SNYwCg4ej3GSmj239JffaDPiYw== X-Received: by 2002:a05:6a21:9101:b0:1cc:9f25:54d4 with SMTP id adf61e73a8af0-1cce10979f6mr7242647637.38.1725083269352; Fri, 30 Aug 2024 22:47:49 -0700 (PDT) Received: from kernelexploit-virtual-machine.localdomain ([121.185.186.233]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2051553442esm34843105ad.135.2024.08.30.22.47.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Aug 2024 22:47:49 -0700 (PDT) From: Jeongjun Park To: martin.lau@linux.dev, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com Cc: song@kernel.org, yonghong.song@linux.dev, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org, mykolal@fb.com, shuah@kernel.org, aha310510@gmail.com, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf,v2,2/2] selftest/bpf : Add a selftest test case to check for incorrect names Date: Sat, 31 Aug 2024 14:47:42 +0900 Message-Id: <20240831054742.364585-1-aha310510@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240831054525.364353-1-aha310510@gmail.com> References: <20240831054525.364353-1-aha310510@gmail.com> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: bpf@iogearbox.net Add selftest for cases where btf_name_valid_section() does not properly check for certain types of names. Suggested-by: Eduard Zingerman Signed-off-by: Jeongjun Park --- tools/testing/selftests/bpf/prog_tests/btf.c | 34 ++++++++++++++++++++ 1 file changed, 34 insertions(+) -- diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/selftests/bpf/prog_tests/btf.c index 00965a6e83bb..61de88cf4ad0 100644 --- a/tools/testing/selftests/bpf/prog_tests/btf.c +++ b/tools/testing/selftests/bpf/prog_tests/btf.c @@ -3550,6 +3550,40 @@ static struct btf_raw_test raw_tests[] = { }, BTF_STR_SEC("\0x\0?.foo bar:buz"), }, +{ + .descr = "datasec: name with non-printable first char not is ok", + .raw_types = { + /* int */ + BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ + /* VAR x */ /* [2] */ + BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1), + BTF_VAR_STATIC, + /* DATASEC ?.data */ /* [3] */ + BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4), + BTF_VAR_SECINFO_ENC(2, 0, 4), + BTF_END_RAW, + }, + BTF_STR_SEC("\0x\0\7foo"), + .err_str = "Invalid name", + .btf_load_err = true, +}, +{ + .descr = "datasec: name '\\0' is not ok", + .raw_types = { + /* int */ + BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ + /* VAR x */ /* [2] */ + BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1), + BTF_VAR_STATIC, + /* DATASEC \0 */ /* [3] */ + BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4), + BTF_VAR_SECINFO_ENC(2, 0, 4), + BTF_END_RAW, + }, + BTF_STR_SEC("\0x\0"), + .err_str = "Invalid name", + .btf_load_err = true, +}, { .descr = "type name '?foo' is not ok", .raw_types = {