[PATCH bpf-next v3 0/1] samples/bpf: syscall_tp_user: Refactor and fix array index out-of-bounds bug

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Ruowen Qin <ruowenq2@xxxxxxxxxxxx>

Thanks to Alexei, patch 2/3 and 3/3 from v2 have been upstreamed. v3
primarily addresses scenarios where the compiler lacks ubsan support.

There are currently 6 BPF programs in syscall_tp_kern but the array to
hold the corresponding bpf_links in syscall_tp_user only has space for 4
programs, given the array size is hardcoded. This causes the sample
program to fail due to an out-of-bound access that corrupts other stack
variables:

  # ./syscall_tp
  prog #0: map ids 4 5
  verify map:4 val: 5
  map_lookup failed: Bad file descriptor

This patch series aims to solve this issue for now and for the future.
It first adds the -fsanitize=bounds flag to make similar bugs more
obvious at runtime. It then refactors syscall_tp_user to retrieve the
number of programs from the bpf_object and dynamically allocate the
array of bpf_links to avoid inconsistencies from hardcoding.

Changelog:
---
v2 -> v3
v2: https://lore.kernel.org/all/20230917214220.637721-1-jinghao7@xxxxxxxxxxxx/

* Address feddback from Alexei
  * Make the makefile smarter to detect the presence of ubsan in the compiler.

v1 -> v2
v1: https://lore.kernel.org/all/20230818164643.97782-1-jinghao@xxxxxxxxxxxxx/

* Address feedback from Daniel
  * Add missing NULL check for calloc return value.
  * Remove the extra operation that sets links pointer to NULL after free.

Ruowen Qin (1):
  samples/bpf: Add -fsanitize=bounds to userspace programs

 samples/bpf/Makefile | 3 +++
 1 file changed, 3 insertions(+)

-- 
2.42.0





[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]


  Powered by Linux