• Hou Tao's avatar
    bpf: Check the remaining info_cnt before repeating btf fields · 797d73ee
    Hou Tao authored
    When trying to repeat the btf fields for array of nested struct, it
    doesn't check the remaining info_cnt. The following splat will be
    reported when the value of ret * nelems is greater than BTF_FIELDS_MAX:
    
      ------------[ cut here ]------------
      UBSAN: array-index-out-of-bounds in ../kernel/bpf/btf.c:3951:49
      index 11 is out of range for type 'btf_field_info [11]'
      CPU: 6 UID: 0 PID: 411 Comm: test_progs ...... 6.11.0-rc4+ #1
      Tainted: [O]=OOT_MODULE
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...
      Call Trace:
       <TASK>
       dump_stack_lvl+0x57/0x70
       dump_stack+0x10/0x20
       ubsan_epilogue+0x9/0x40
       __ubsan_handle_out_of_bounds+0x6f/0x80
       ? kallsyms_lookup_name+0x48/0xb0
       btf_parse_fields+0x992/0xce0
       map_create+0x591/0x770
       __sys_bpf+0x229/0x2410
       __x64_sys_bpf+0x1f/0x30
       x64_sys_call+0x199/0x9f0
       do_syscall_64+0x3b/0xc0
       entry_SYSCALL_64_after_hwframe+0x4b/0x53
      RIP: 0033:0x7fea56f2cc5d
      ......
       </TASK>
      ---[ end trace ]---
    
    Fix it by checking the remaining info_cnt in btf_repeat_fields() before
    repeating the btf fields.
    
    Fixes: 64e8ee81 ("bpf: look into the types of the fields of a struct type recursively.")
    Signed-off-by: default avatarHou Tao <houtao1@huawei.com>
    Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
    Link: https://lore.kernel.org/r/20241008071114.3718177-2-houtao@huaweicloud.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    797d73ee
btf.c 237 KB