Commit 350a5c4d authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by Daniel Borkmann
Browse files

bpf: Dont allow vmlinux BTF to be used in map_create and prog_load. 



The syzbot got FD of vmlinux BTF and passed it into map_create which caused
crash in btf_type_id_size() when it tried to access resolved_ids. The vmlinux
BTF doesn't have 'resolved_ids' and 'resolved_sizes' initialized to save
memory. To avoid such issues disallow using vmlinux BTF in prog_load and
map_create commands.

Fixes: 53297220 ("bpf: Assign ID to vmlinux BTF and return extra info for BTF in GET_OBJ_INFO")
Reported-by: default avatar <syzbot+8bab8ed346746e7540e8@syzkaller.appspotmail.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarYonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20210307225248.79031-1-alexei.starovoitov@gmail.com
parent edbea922

kernel/bpf/syscall.c

+5 −0
Original line number Diff line number Diff line
@@ -854,6 +854,11 @@ static int map_create(union bpf_attr *attr) 
			err = PTR_ERR(btf);

			goto free_map;

		}

		if (btf_is_kernel(btf)) {

			btf_put(btf);

			err = -EACCES;

			goto free_map;

		}

		map->btf = btf;



		if (attr->btf_value_type_id) {

kernel/bpf/verifier.c

+4 −0
Original line number Diff line number Diff line
@@ -9056,6 +9056,10 @@ static int check_btf_info(struct bpf_verifier_env *env, 
	btf = btf_get_by_fd(attr->prog_btf_fd);

	if (IS_ERR(btf))

		return PTR_ERR(btf);

	if (btf_is_kernel(btf)) {

		btf_put(btf);

		return -EACCES;

	}

	env->prog->aux->btf = btf;



	err = check_btf_func(env, attr, uattr);