github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

libbpf: Fix use-after-free in btf__add_type

Browse Source 
For every string btf_rewrite_str() does:

  off = btf__add_str(p->dst, btf__str_by_offset(p->src, *str_off));

When the string belongs to the base, the pointer goes into the raw data
of the base. btf__add_str() looks the string up in the base first,
btf__find_str() calls btf_ensure_modifiable() on the base, and that
frees the raw data. Then strset__find_str() reads the freed string.

Make all the bases of dst modifiable before the pointer is taken.

This bug is triggered by the sharing of BTF bases between src
and dst, as introduced by the resolve_btfids changes to build
inline BTF.

Fixes: cf91a7db92 ("resolve_btfids: Build separate main and inline BTF objects")
Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alan Maguire <almagui@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Tested-by: Alan Maguire <almagui@kernel.org>
Link: https://patch.msgid.link/20261102185839.1190122-1-almagui@kernel.org
This commit is contained in:
Alexei Starovoitov 2026-11-02 18:58:39 +00:00
parent 38bce81d47
commit 9abe2c42ec
No known key found for this signature in database
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
tools/lib/bpf/btf.c
View File

@ -2222,6 +2222,7 @@ struct btf_pipe {
static int btf_rewrite_str(struct btf_pipe *p, __u32 *str_off)
{
struct btf *base;
long mapped_off;
int off, err;
@ -2234,6 +2235,19 @@ static int btf_rewrite_str(struct btf_pipe *p, __u32 *str_off)
return 0;
}
/*
* btf__add_str() first looks the string up in the base BTFs of dst,
* which makes each of them modifiable and frees its raw data. If src
* shares a base with dst and the string lives in that base, the
* pointer taken below would be left dangling. So make the bases
* modifiable before the pointer is taken.
*/
for (base = p->dst->base_btf; base; base = base->base_btf) {
err = btf_ensure_modifiable(base);
if (err)
return err;
}
off = btf__add_str(p->dst, btf__str_by_offset(p->src, *str_off));
if (off < 0)
return off;