• Ilya Leoshkevich's avatar
    libbpf: Fix unbounded memory access in bpf_usdt_arg() · 25c76ed4
    Ilya Leoshkevich authored
    Loading programs that use bpf_usdt_arg() on s390x fails with:
    
        ; if (arg_num >= BPF_USDT_MAX_ARG_CNT || arg_num >= spec->arg_cnt)
        128: (79) r1 = *(u64 *)(r10 -24)      ; frame1: R1_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) R10=fp0
        129: (25) if r1 > 0xb goto pc+83      ; frame1: R1_w=scalar(umax=11,var_off=(0x0; 0xf))
        ...
        ; arg_spec = &spec->args[arg_num];
        135: (79) r1 = *(u64 *)(r10 -24)      ; frame1: R1_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) R10=fp0
        ...
        ; switch (arg_spec->arg_type) {
        139: (61) r1 = *(u32 *)(r2 +8)
        R2 unbounded memory access, make sure to bounds check any such access
    
    The reason is that, even though the C code enforces that
    arg_num < BPF_USDT_MAX_ARG_CNT, the verifier cannot propagate this
    constraint to the arg_spec assignment yet. Help it by forcing r1 back
    to stack after comparison.
    Signed-off-by: default avatarIlya Leoshkevich <iii@linux.ibm.com>
    Link: https://lore.kernel.org/r/20230128000650.1516334-23-iii@linux.ibm.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    25c76ed4
usdt.bpf.h 8.42 KB