Commit 8ca990ce authored by Andrii Nakryiko's avatar Andrii Nakryiko Committed by Daniel Borkmann

libbpf: fix detection of corrupted BPF instructions section

Ensure that size of a section w/ BPF instruction is exactly a multiple
of BPF instruction size.
Signed-off-by: default avatarAndrii Nakryiko <andriin@fb.com>
Acked-by: default avatarSong Liu <songliubraving@fb.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent 501b125a
...@@ -349,8 +349,11 @@ static int ...@@ -349,8 +349,11 @@ static int
bpf_program__init(void *data, size_t size, char *section_name, int idx, bpf_program__init(void *data, size_t size, char *section_name, int idx,
struct bpf_program *prog) struct bpf_program *prog)
{ {
if (size < sizeof(struct bpf_insn)) { const size_t bpf_insn_sz = sizeof(struct bpf_insn);
pr_warning("corrupted section '%s'\n", section_name);
if (size == 0 || size % bpf_insn_sz) {
pr_warning("corrupted section '%s', size: %zu\n",
section_name, size);
return -EINVAL; return -EINVAL;
} }
...@@ -376,9 +379,8 @@ bpf_program__init(void *data, size_t size, char *section_name, int idx, ...@@ -376,9 +379,8 @@ bpf_program__init(void *data, size_t size, char *section_name, int idx,
section_name); section_name);
goto errout; goto errout;
} }
prog->insns_cnt = size / sizeof(struct bpf_insn); prog->insns_cnt = size / bpf_insn_sz;
memcpy(prog->insns, data, memcpy(prog->insns, data, size);
prog->insns_cnt * sizeof(struct bpf_insn));
prog->idx = idx; prog->idx = idx;
prog->instances.fds = NULL; prog->instances.fds = NULL;
prog->instances.nr = -1; prog->instances.nr = -1;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment