[PATCH AUTOSEL 5.10 003/116] libbpf: Validate that .BTF and .BTF.ext sections contain data

public inbox for netdev@vger.kernel.org 
 help / color / mirror / Atom feed

From: Sasha Levin <sashal@kernel•org>
To: linux-kernel@vger•kernel.org, stable@vger•kernel.org
Cc: Andrii Nakryiko <andrii@kernel•org>,
	Alexei Starovoitov <ast@kernel•org>, Yonghong Song <yhs@fb•com>,
	Sasha Levin <sashal@kernel•org>,
	daniel@iogearbox•net, netdev@vger•kernel.org,
	bpf@vger•kernel.org
Subject: [PATCH AUTOSEL 5.10 003/116] libbpf: Validate that .BTF and .BTF.ext sections contain data
Date: Mon, 17 Jan 2022 21:38:14 -0500	[thread overview]
Message-ID: <20220118024007.1950576-3-sashal@kernel.org> (raw)
In-Reply-To: <20220118024007.1950576-1-sashal@kernel.org>

From: Andrii Nakryiko <andrii@kernel•org>

[ Upstream commit 62554d52e71797eefa3fc15b54008038837bb2d4 ]

.BTF and .BTF.ext ELF sections should have SHT_PROGBITS type and contain
data. If they are not, ELF is invalid or corrupted, so bail out.
Otherwise this can lead to data->d_buf being NULL and SIGSEGV later on.
Reported by oss-fuzz project.

Signed-off-by: Andrii Nakryiko <andrii@kernel•org>
Signed-off-by: Alexei Starovoitov <ast@kernel•org>
Acked-by: Yonghong Song <yhs@fb•com>
Link: https://lore.kernel.org/bpf/20211103173213.1376990-4-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel•org>
---
 tools/lib/bpf/libbpf.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index b337d6f29098b..e8ad53d31044a 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -2870,8 +2870,12 @@ static int bpf_object__elf_collect(struct bpf_object *obj)
 		} else if (strcmp(name, MAPS_ELF_SEC) == 0) {
 			obj->efile.btf_maps_shndx = idx;
 		} else if (strcmp(name, BTF_ELF_SEC) == 0) {
+			if (sh->sh_type != SHT_PROGBITS)
+				return -LIBBPF_ERRNO__FORMAT;
 			btf_data = data;
 		} else if (strcmp(name, BTF_EXT_ELF_SEC) == 0) {
+			if (sh->sh_type != SHT_PROGBITS)
+				return -LIBBPF_ERRNO__FORMAT;
 			btf_ext_data = data;
 		} else if (sh.sh_type == SHT_SYMTAB) {
 			/* already processed during the first pass above */
-- 
2.34.1

next prev parent reply	other threads:[~2022-01-18  2:43 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-01-18  2:38 [PATCH AUTOSEL 5.10 001/116] Bluetooth: Fix debugfs entry leak in hci_register_dev() Sasha Levin
2022-01-18  2:38 ` Sasha Levin [this message]
2022-01-18  2:38 ` [PATCH AUTOSEL 5.10 005/116] selftests/bpf: Fix bpf_object leak in skb_ctx selftest Sasha Levin
2022-01-18  2:38 ` [PATCH AUTOSEL 5.10 006/116] ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply Sasha Levin
2022-01-18  2:38 ` [PATCH AUTOSEL 5.10 013/116] batman-adv: allow netlink usage in unprivileged containers Sasha Levin
2022-01-18  2:38 ` [PATCH AUTOSEL 5.10 015/116] ath11k: Fix crash caused by uninitialized TX ring Sasha Levin
2022-01-18  2:38 ` [PATCH AUTOSEL 5.10 025/116] mlxsw: pci: Add shutdown method in PCI driver Sasha Levin
2022-01-18  2:38 ` [PATCH AUTOSEL 5.10 031/116] mwifiex: Fix skb_over_panic in mwifiex_usb_recv() Sasha Levin
2022-01-18  2:38 ` [PATCH AUTOSEL 5.10 032/116] rsi: Fix use-after-free in rsi_rx_done_handler() Sasha Levin
2022-01-18  2:38 ` [PATCH AUTOSEL 5.10 033/116] rsi: Fix out-of-bounds read in rsi_read_pkt() Sasha Levin
2022-01-18  2:38 ` [PATCH AUTOSEL 5.10 034/116] ath11k: Avoid NULL ptr access during mgmt tx cleanup Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 050/116] iwlwifi: mvm: synchronize with FW after multicast commands Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 051/116] iwlwifi: mvm: avoid clearing a just saved session protection id Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 052/116] net: dsa: ocelot: felix: Remove requirement for PCS in felix devices Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 053/116] ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 054/116] ath10k: Fix tx hanging Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 055/116] net-sysfs: update the queue counts in the unregistration path Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 056/116] net: phy: prefer 1000baseT over 1000baseKX Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 059/116] net: Enable neighbor sysctls that is save for userns root Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 060/116] ath11k: Avoid false DEADLOCK warning reported by lockdep Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 065/116] net: bonding: debug: avoid printing debug logs when bond is not notifying peers Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 066/116] bpf: Do not WARN in bpf_warn_invalid_xdp_action() Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 077/116] ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 078/116] rtw88: 8822c: update rx settings to prevent potential hw deadlock Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 080/116] iwlwifi: fix leaks/bad data after failed firmware load Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 081/116] iwlwifi: remove module loading failure message Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 082/116] iwlwifi: mvm: Fix calculation of frame length Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 083/116] iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 085/116] ath11k: Fix napi related hang Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 087/116] xfrm: rate limit SA mapping change message to user space Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 101/116] net: mdio: Demote probed message to debug print Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 102/116] mac80211: allow non-standard VHT MCS-10/11 Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 105/116] mlxsw: pci: Avoid flow control for EMAD packets Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 106/116] net: phy: marvell: configure RGMII delays for 88E1118 Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 107/116] net: gemini: allow any RGMII interface mode Sasha Levin
2022-01-18  2:39 ` [PATCH AUTOSEL 5.10 108/116] net: dsa: hold rtnl_mutex when calling dsa_master_{setup,teardown} Sasha Levin
2022-01-18 17:13 ` [PATCH AUTOSEL 5.10 001/116] Bluetooth: Fix debugfs entry leak in hci_register_dev() Pavel Machek
2022-01-22 19:25   ` Sasha Levin

find likely ancestor, descendant, or conflicting patches for this message:
( dfblob:b337d6f29098 dfblob:e8ad53d31044 )
 OR (
bs:"[PATCH AUTOSEL 5.10 003/116] libbpf: Validate that .BTF and .BTF.ext sections contain data" )
	(help)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220118024007.1950576-3-sashal@kernel.org \
    --to=sashal@kernel$(echo .)org \
    --cc=andrii@kernel$(echo .)org \
    --cc=ast@kernel$(echo .)org \
    --cc=bpf@vger$(echo .)kernel.org \
    --cc=daniel@iogearbox$(echo .)net \
    --cc=linux-kernel@vger$(echo .)kernel.org \
    --cc=netdev@vger$(echo .)kernel.org \
    --cc=stable@vger$(echo .)kernel.org \
    --cc=yhs@fb$(echo .)com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox