On 12/11/24 3:28 PM, rtm@xxxxxxxxxxxxx wrote:
Martin,
When I build from bpf-next/master with a default .config, I do not get
the crash.
When I disable CONFIG_MODULES, I do get a crash from tcpbps12a.c.
During make:
"WARN: resolve_btfids: unresolved symbol module"
Without going into the details, the bpf_try_module_get failed to bump the refcnt
because of missing the "struct module" btf_id.
With a quick thought, I see bpf_struct_ops should be able to work around this
CONFIG_MODULES=n.
I don't think it should though. The bpf_tcp_ca is using the "struct
tcp_congestion_ops" which can be implemented by a kernel module and the kconfig
wants nothing other than the built-in tcp-cc. I don't think the bpf_struct_ops
should be a way to work around that. I think the right thing to do here is to
also disallow attaching bpf_struct_ops when CONFIG_MODULES=n to fix this UAF issue.
