github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Merge branch 'bpf-check-tail-zero-of-bpf_map_info-and-bpf_prog_info'

Browse Source 
Leon Hwang says:

====================
bpf: Check tail zero of bpf_map_info and bpf_prog_info

Check the tail bytes of bpf_map_info and bpf_prog_info due to padding
when getting map info and prog info via BPF_OBJ_GET_INFO_BY_FD, which
was discussed in the thread
"bpf: Check tail zero of bpf_common_attr using offsetofend" [1].

Links:
[1] https://lore.kernel.org/bpf/20260518145446.6794-2-leon.hwang@linux.dev/

Changes:
v2 -> v3:
* Add "__u32 :32" to bpf_map_info and bpf_prog_info (per Alexei).
* v2: https://lore.kernel.org/bpf/20260604150505.99129-1-leon.hwang@linux.dev/

v1 -> v2:
* Collect Acked-by tags from Mykyta, thanks.
* Update Fixes tag in patch #2 (per bot+bpf-ci)
* v1: https://lore.kernel.org/bpf/20260603144518.67065-1-leon.hwang@linux.dev/
====================

Link: https://patch.msgid.link/20260605155249.20772-1-leon.hwang@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Alexei Starovoitov 2026-06-05 15:21:24 -07:00
commit a1f1acf6a1
4 changed files with 65 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/uapi/linux/bpf.h
View File

@ -6712,6 +6712,7 @@ struct bpf_prog_info {
__u32 verified_insns;
__u32 attach_btf_obj_id;
__u32 attach_btf_id;
__u32 :32;
} __attribute__((aligned(8)));
struct bpf_map_info {
@ -6733,6 +6734,7 @@ struct bpf_map_info {
__u64 map_extra;
__aligned_u64 hash;
__u32 hash_size;
__u32 :32;
} __attribute__((aligned(8)));
struct bpf_btf_info {

10
kernel/bpf/syscall.c
View File

@ -5121,10 +5121,11 @@ static int bpf_prog_get_info_by_fd(struct file *file,
u32 info_len = attr->info.info_len;
struct bpf_prog_kstats stats;
char __user *uinsns;
u32 ulen;
u32 ulen, len;
int err;
err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), sizeof(info), info_len);
len = offsetofend(struct bpf_prog_info, attach_btf_id);
err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), len, info_len);
if (err)
return err;
info_len = min_t(u32, sizeof(info), info_len);
@ -5406,10 +5407,11 @@ static int bpf_map_get_info_by_fd(struct file *file,
{
struct bpf_map_info __user *uinfo = u64_to_user_ptr(attr->info.info);
struct bpf_map_info info;
u32 info_len = attr->info.info_len;
u32 info_len = attr->info.info_len, len;
int err;
err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), sizeof(info), info_len);
len = offsetofend(struct bpf_map_info, hash_size);
err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), len, info_len);
if (err)
return err;
info_len = min_t(u32, sizeof(info), info_len);

2
tools/include/uapi/linux/bpf.h
View File

@ -6712,6 +6712,7 @@ struct bpf_prog_info {
__u32 verified_insns;
__u32 attach_btf_obj_id;
__u32 attach_btf_id;
__u32 :32;
} __attribute__((aligned(8)));
struct bpf_map_info {
@ -6733,6 +6734,7 @@ struct bpf_map_info {
__u64 map_extra;
__aligned_u64 hash;
__u32 hash_size;
__u32 :32;
} __attribute__((aligned(8)));
struct bpf_btf_info {

55
tools/testing/selftests/bpf/prog_tests/bpf_attr_size.c
View File

@ -62,8 +62,63 @@ static void test_query_size_boundaries(void)
cgroup_skb_direct_packet_access__destroy(skel);
}
static void test_map_info_tail_zero(void)
{
LIBBPF_OPTS(bpf_map_create_opts, map_opts);
struct bpf_map_info_fake {
__u8 info[offsetofend(struct bpf_map_info, hash_size)];
__u32 pad;
} info = {
.pad = 1,
};
int map_fd, err;
__u32 info_len;
map_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, "arr", sizeof(int), 1, 1, &map_opts);
if (!ASSERT_GE(map_fd, 0, "bpf_map_create"))
return;
info_len = sizeof(info);
err = bpf_obj_get_info_by_fd(map_fd, &info, &info_len);
ASSERT_EQ(err, -E2BIG, "bpf_obj_get_info_by_fd");
close(map_fd);
}
static void test_prog_info_tail_zero(void)
{
LIBBPF_OPTS(bpf_prog_load_opts, prog_opts);
struct bpf_insn insns[] = {
BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_EXIT_INSN(),
};
struct bpf_prog_info_fake {
__u8 info[offsetofend(struct bpf_prog_info, attach_btf_id)];
__u32 pad;
} info = {
.pad = 1,
};
int prog_fd, err;
__u32 info_len;
prog_fd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, "test_prog", "GPL", insns,
ARRAY_SIZE(insns), &prog_opts);
if (!ASSERT_GE(prog_fd, 0, "bpf_prog_load"))
return;
info_len = sizeof(info);
err = bpf_obj_get_info_by_fd(prog_fd, &info, &info_len);
ASSERT_EQ(err, -E2BIG, "bpf_obj_get_info_by_fd");
close(prog_fd);
}
void test_bpf_attr_size(void)
{
if (test__start_subtest("query_size_boundaries"))
test_query_size_boundaries();
if (test__start_subtest("map_info_tail_zero"))
test_map_info_tail_zero();
if (test__start_subtest("prog_info_tail_zero"))
test_prog_info_tail_zero();
}