mirror of
https://github.com/torvalds/linux.git
synced 2026-09-18 16:48:03 +02:00
77f02c9926
When btf_parse_elf() is called without a caller-supplied base_btf (i.e. via the public btf__parse_elf()) and the object file carries a .BTF.base (distilled base) section, a dist_base_btf object is created and used as the base of the split BTF built from the .BTF section. Because base_btf is NULL, the relocation block that would otherwise free and clear dist_base_btf is skipped, and ownership of dist_base_btf is instead transferred to the split btf by setting btf->owns_base = true. That ownership transfer was performed before the fallible btf_ext__new() call that parses the .BTF.ext section. If .BTF.ext is malformed, btf_ext__new() fails and the function jumps to the error path, which frees dist_base_btf directly and then frees btf. Since owns_base is already set, btf__free(btf) also frees btf->base_btf, which is the same dist_base_btf object. The result is a use-after-free read followed by a double free of the base BTF, driven entirely by a crafted object file (a .BTF + .BTF.base + malformed .BTF.ext combination) passed to btf__parse_elf(), as used by bpftool, pahole and similar tools. Transfer ownership only after .BTF.ext has been parsed successfully, so that any earlier failure leaves dist_base_btf owned solely by the local cleanup path and it is freed exactly once. Signed-off-by: Naveed Khan <naveed@digiscrypt.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/178345549172.94179.7948304165383170781@digiscrypt.com |
||
|---|---|---|
| .. | ||
| api | ||
| bpf | ||
| perf | ||
| python | ||
| subcmd | ||
| symbol | ||
| thermal | ||
| argv_split.c | ||
| bitmap.c | ||
| cmdline.c | ||
| ctype.c | ||
| find_bit.c | ||
| hweight.c | ||
| list_sort.c | ||
| rbtree.c | ||
| slab.c | ||
| str_error_r.c | ||
| string.c | ||
| vsprintf.c | ||
| zalloc.c | ||