• Daniel Borkmann's avatar
    bpf, trace: make ctx access checks more robust · 2d071c64
    Daniel Borkmann authored
    Make sure that ctx cannot potentially be accessed oob by asserting
    explicitly that ctx access size into pt_regs for BPF_PROG_TYPE_KPROBE
    programs must be within limits. In case some 32bit archs have pt_regs
    not being a multiple of 8, then BPF_DW access could cause such access.
    
    BPF_PROG_TYPE_KPROBE progs don't have a ctx conversion function since
    there's no extra mapping needed. kprobe_prog_is_valid_access() didn't
    enforce sizeof(long) as the only allowed access size, since LLVM can
    generate non BPF_W/BPF_DW access to regs from time to time.
    
    For BPF_PROG_TYPE_TRACEPOINT we don't have a ctx conversion either, so
    add a BUILD_BUG_ON() check to make sure that BPF_DW access will not be
    a similar issue in future (ctx works on event buffer as opposed to
    pt_regs there).
    
    Fixes: 2541517c ("tracing, perf: Implement BPF programs attached to kprobes")
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    2d071c64
bpf_trace.c 16.2 KB