github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bpf: Verify BTF_KIND_LOC_PARAM vlen, flags

Browse Source 
Ensure that vlen and flags combinations are consistent for
BTF_KIND_LOC_PARAMs.

Fixes: 33c5a3278b ("btf: Extend UAPI to support BTF location (inline site) info")
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260926175113.2368566-2-alan.maguire@oracle.com
This commit is contained in:
Alan Maguire 2026-09-26 18:51:11 +01:00 committed by Alexei Starovoitov
parent 2a8f078e4f
commit a3df11403e
No known key found for this signature in database
1 changed files with 43 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
kernel/bpf/btf.c
View File

@ -4823,10 +4823,53 @@ static s32 btf_loc_param_check_meta(struct btf_verifier_env *env,
btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
return -EINVAL;
}
/* All LOC_PARAMs have vlen of at least 1 */
if (vlen < 1)
goto invalid_vlen;
switch (p->flags) {
case BTF_LOC_PARAM_CONST:
case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_SIGNED:
case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR:
case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR | BTF_LOC_PARAM_SIGNED:
if (vlen > 2)
goto invalid_vlen;
/* Ensure size/vlen are consistent */
if (size > sizeof(__u32) && vlen != 2)
goto invalid_vlen;
if (size > sizeof(__u64))
goto invalid_vlen;
break;
case BTF_LOC_PARAM_REG:
/* Reg or reg/reg pair */
if (vlen > 2)
goto invalid_vlen;
break;
case BTF_LOC_PARAM_REG | BTF_LOC_PARAM_DEREF:
/* A reg deref without offset can only have vlen 1 */
if (vlen != 1)
goto invalid_vlen;
break;
case BTF_LOC_PARAM_REG | BTF_LOC_PARAM_OFFSET:
case BTF_LOC_PARAM_REG | BTF_LOC_PARAM_OFFSET | BTF_LOC_PARAM_SIGNED:
case BTF_LOC_PARAM_REG | BTF_LOC_PARAM_DEREF | BTF_LOC_PARAM_OFFSET:
case BTF_LOC_PARAM_REG | BTF_LOC_PARAM_DEREF | BTF_LOC_PARAM_OFFSET |
BTF_LOC_PARAM_SIGNED:
if (vlen < 2 || vlen > 3)
goto invalid_vlen;
break;
default:
btf_verifier_log_type(env, t, "Invalid flags");
return -EINVAL;
}
btf_verifier_log_type(env, t, NULL);
return meta_needed;
invalid_vlen:
btf_verifier_log_type(env, t, "Invalid vlen");
return -EINVAL;
}
static void btf_loc_param_log(struct btf_verifier_env *env,