]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/commit
bpf: Dont allow vmlinux BTF to be used in map_create and prog_load.
authorAlexei Starovoitov <ast@kernel.org>
Sun, 7 Mar 2021 22:52:48 +0000 (14:52 -0800)
committerSeth Forshee <seth.forshee@canonical.com>
Thu, 8 Apr 2021 20:42:31 +0000 (15:42 -0500)
commit717d94764788211c14bb7eae192c0e0e1e9c268a
treed4d15ef70d8afd8abd619aeadb38956fd83bb5c4
parent4c0f2a474cb99a49cc8b6b890a3aa1653337ec41
bpf: Dont allow vmlinux BTF to be used in map_create and prog_load.

BugLink: https://bugs.launchpad.net/bugs/1922601
[ Upstream commit 350a5c4dd2452ea999cc5e1d4a8dbf12de2f97ef ]

The syzbot got FD of vmlinux BTF and passed it into map_create which caused
crash in btf_type_id_size() when it tried to access resolved_ids. The vmlinux
BTF doesn't have 'resolved_ids' and 'resolved_sizes' initialized to save
memory. To avoid such issues disallow using vmlinux BTF in prog_load and
map_create commands.

Fixes: 5329722057d4 ("bpf: Assign ID to vmlinux BTF and return extra info for BTF in GET_OBJ_INFO")
Reported-by: syzbot+8bab8ed346746e7540e8@syzkaller.appspotmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20210307225248.79031-1-alexei.starovoitov@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
kernel/bpf/syscall.c
kernel/bpf/verifier.c