Commit a2aa95b7 authored by Yuntao Wang's avatar Yuntao Wang Committed by Alexei Starovoitov
Browse files

bpf: Fix potential array overflow in bpf_trampoline_get_progs() 



The cnt value in the 'cnt >= BPF_MAX_TRAMP_PROGS' check does not
include BPF_TRAMP_MODIFY_RETURN bpf programs, so the number of
the attached BPF_TRAMP_MODIFY_RETURN bpf programs in a trampoline
can exceed BPF_MAX_TRAMP_PROGS.

When this happens, the assignment '*progs++ = aux->prog' in
bpf_trampoline_get_progs() will cause progs array overflow as the
progs field in the bpf_tramp_progs struct can only hold at most
BPF_MAX_TRAMP_PROGS bpf programs.

Fixes: 88fd9e53 ("bpf: Refactor trampoline update code")
Signed-off-by: default avatarYuntao Wang <ytcoode@gmail.com>
Link: https://lore.kernel.org/r/20220430130803.210624-1-ytcoode@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 5790a2fe

kernel/bpf/trampoline.c

+12 −6
Original line number Diff line number Diff line
@@ -415,7 +415,7 @@ int bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline 
	enum bpf_tramp_prog_type kind;

	struct bpf_tramp_link *link_exiting;

	int err = 0;

	int cnt;

	int cnt = 0, i;



	kind = bpf_attach_type_to_tramp(link->link.prog);

	mutex_lock(&tr->mutex);
@@ -426,7 +426,10 @@ int bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline 
		err = -EBUSY;

		goto out;

	}

	cnt = tr->progs_cnt[BPF_TRAMP_FENTRY] + tr->progs_cnt[BPF_TRAMP_FEXIT];



	for (i = 0; i < BPF_TRAMP_MAX; i++)

		cnt += tr->progs_cnt[i];



	if (kind == BPF_TRAMP_REPLACE) {

		/* Cannot attach extension if fentry/fexit are in use. */

		if (cnt) {
@@ -512,16 +515,19 @@ struct bpf_trampoline *bpf_trampoline_get(u64 key, 


void bpf_trampoline_put(struct bpf_trampoline *tr)

{

	int i;



	if (!tr)

		return;

	mutex_lock(&trampoline_mutex);

	if (!refcount_dec_and_test(&tr->refcnt))

		goto out;

	WARN_ON_ONCE(mutex_is_locked(&tr->mutex));

	if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[BPF_TRAMP_FENTRY])))

		goto out;

	if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[BPF_TRAMP_FEXIT])))



	for (i = 0; i < BPF_TRAMP_MAX; i++)

		if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[i])))

			goto out;



	/* This code will be executed even when the last bpf_tramp_image

	 * is alive. All progs are detached from the trampoline and the

	 * trampoline image is patched with jmp into epilogue to skip