From f9b74ef61f77bf6e9a20ceb74ab03d3d68b48b7c Mon Sep 17 00:00:00 2001 From: zhang-mingyi66 Date: Mon, 23 Dec 2024 11:17:39 +0800 Subject: [PATCH] backport from upstream Signed-off-by: zhang-mingyi66 (cherry picked from commit df1994dbe800177b3b184a607e9634d19e0d3b23) --- ...-direct-pointers-into-BTF-data-from-.patch | 103 ++++++++++++++++++ libbpf.spec | 7 +- 2 files changed, 109 insertions(+), 1 deletion(-) create mode 100644 backport-libbpf-Dont-take-direct-pointers-into-BTF-data-from-.patch diff --git a/backport-libbpf-Dont-take-direct-pointers-into-BTF-data-from-.patch b/backport-libbpf-Dont-take-direct-pointers-into-BTF-data-from-.patch new file mode 100644 index 0000000..7cf255d --- /dev/null +++ b/backport-libbpf-Dont-take-direct-pointers-into-BTF-data-from-.patch @@ -0,0 +1,103 @@ +From 7b5237996a42c3b8a6fe8ccae656047de2831f58 Mon Sep 17 00:00:00 2001 +From: David Vernet +Date: Wed, 24 Jul 2024 12:14:58 -0500 +Subject: [PATCH] libbpf: Don't take direct pointers into BTF data from st_ops + +In struct bpf_struct_ops, we have take a pointer to a BTF type name, and +a struct btf_type. This was presumably done for convenience, but can +actually result in subtle and confusing bugs given that BTF data can be +invalidated before a program is loaded. For example, in sched_ext, we +may sometimes resize a data section after a skeleton has been opened, +but before the struct_ops scheduler map has been loaded. This may cause +the BTF data to be realloc'd, which can then cause a UAF when loading +the program because the struct_ops map has pointers directly into the +BTF data. + +We're already storing the BTF type_id in struct bpf_struct_ops. Because +type_id is stable, we can therefore just update the places where we were +looking at those pointers to instead do the lookups we need from the +type_id. + +Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support") +Signed-off-by: David Vernet +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20240724171459.281234-1-void@manifault.com +--- + src/libbpf.c | 19 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/src/libbpf.c b/src/libbpf.c +index a3be6f8fa..e55353887 100644 +--- a/src/libbpf.c ++++ b/src/libbpf.c +@@ -496,8 +496,6 @@ struct bpf_program { + }; + + struct bpf_struct_ops { +- const char *tname; +- const struct btf_type *type; + struct bpf_program **progs; + __u32 *kern_func_off; + /* e.g. struct tcp_congestion_ops in bpf_prog's btf format */ +@@ -1121,8 +1122,8 @@ static int bpf_map__init_kern_struct_ops(struct bpf_map *map) + int err; + + st_ops = map->st_ops; +- type = st_ops->type; +- tname = st_ops->tname; ++ type = btf__type_by_id(btf, st_ops->type_id); ++ tname = btf__name_by_offset(btf, type->name_off); + err = find_struct_ops_kern_types(kern_btf, tname, + &kern_type, &kern_type_id, + &kern_vtype, &kern_vtype_id, +@@ -1423,8 +1424,6 @@ static int init_struct_ops_maps(struct bpf_object *obj, const char *sec_name, + memcpy(st_ops->data, + data->d_buf + vsi->offset, + type->size); +- st_ops->tname = tname; +- st_ops->type = type; + st_ops->type_id = type_id; + + pr_debug("struct_ops init: struct %s(type_id=%u) %s found at offset %u\n", +@@ -8445,11 +8444,13 @@ static int bpf_object__resolve_externs(struct bpf_object *obj, + + static void bpf_map_prepare_vdata(const struct bpf_map *map) + { ++ const struct btf_type *type; + struct bpf_struct_ops *st_ops; + __u32 i; + + st_ops = map->st_ops; +- for (i = 0; i < btf_vlen(st_ops->type); i++) { ++ type = btf__type_by_id(map->obj->btf, st_ops->type_id); ++ for (i = 0; i < btf_vlen(type); i++) { + struct bpf_program *prog = st_ops->progs[i]; + void *kern_data; + int prog_fd; +@@ -9712,6 +9713,7 @@ static struct bpf_map *find_struct_ops_map_by_offset(struct bpf_object *obj, + static int bpf_object__collect_st_ops_relos(struct bpf_object *obj, + Elf64_Shdr *shdr, Elf_Data *data) + { ++ const struct btf_type *type; + const struct btf_member *member; + struct bpf_struct_ops *st_ops; + struct bpf_program *prog; +@@ -9771,13 +9773,14 @@ static int bpf_object__collect_st_ops_relos(struct bpf_object *obj, + } + insn_idx = sym->st_value / BPF_INSN_SZ; + +- member = find_member_by_offset(st_ops->type, moff * 8); ++ type = btf__type_by_id(btf, st_ops->type_id); ++ member = find_member_by_offset(type, moff * 8); + if (!member) { + pr_warn("struct_ops reloc %s: cannot find member at moff %u\n", + map->name, moff); + return -EINVAL; + } +- member_idx = member - btf_members(st_ops->type); ++ member_idx = member - btf_members(type); + name = btf__name_by_offset(btf, member->name_off); + + if (!resolve_func_ptr(btf, member->type, NULL)) { +-- +2.23.0 diff --git a/libbpf.spec b/libbpf.spec index c0746a0..caa48c4 100644 --- a/libbpf.spec +++ b/libbpf.spec @@ -4,7 +4,7 @@ Name: %{githubname} Version: %{githubver} -Release: 5 +Release: 6 Summary: Libbpf library License: LGPLv2 or BSD @@ -21,6 +21,7 @@ Patch0004: backport-libbpf-Free-btf_vmlinux-when-closing-bpf_object.patch Patch0005: backport-libbpf-Avoid-uninitialized-value-in-BPF_CORE_READ_BI.patch Patch0006: backport-libbpf-Add-NULL-checks-to-bpf_object__prev_map,next_.patch Patch0007: backport-libbpf-Apply-map_set_def_max_entries-for-inner_maps-.patch +Patch0008: backport-libbpf-Dont-take-direct-pointers-into-BTF-data-from-.patch # This package supersedes libbpf from kernel-tools, # which has default Epoch: 0. By having Epoch: 1 @@ -73,6 +74,10 @@ developing applications that use %{name} %{_libdir}/libbpf.a %changelog +* Mon Dec 23 2024 zhangmingyi 2:1.2.2-6 +- backport patch from upstream: + backport-libbpf-Dont-take-direct-pointers-into-BTF-data-from-.patch + * Wed Oct 09 2024 zhangmingyi 2:1.2.2-5 - backport patch from upstream: backport-libbpf-Add-NULL-checks-to-bpf_object__prev_map,next_.patch -- Gitee