Patch "bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-correctly-handle-malformed-bpf_core_type_id_loca.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e01be549181b7ad4283f1d75f02016faaa39159a
Author: Eduard Zingerman <eddyz87@xxxxxxxxx>
Date:   Thu Aug 22 01:01:23 2024 -0700

    bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
    
    [ Upstream commit 3d2786d65aaa954ebd3fcc033ada433e10da21c4 ]
    
    In case of malformed relocation record of kind BPF_CORE_TYPE_ID_LOCAL
    referencing a non-existing BTF type, function bpf_core_calc_relo_insn
    would cause a null pointer deference.
    
    Fix this by adding a proper check upper in call stack, as malformed
    relocation records could be passed from user space.
    
    Simplest reproducer is a program:
    
        r0 = 0
        exit
    
    With a single relocation record:
    
        .insn_off = 0,          /* patch first instruction */
        .type_id = 100500,      /* this type id does not exist */
        .access_str_off = 6,    /* offset of string "0" */
        .kind = BPF_CORE_TYPE_ID_LOCAL,
    
    See the link for original reproducer or next commit for a test case.
    
    Fixes: 74753e1462e7 ("libbpf: Replace btf__type_by_id() with btf_type_by_id().")
    Reported-by: Liu RuiTong <cnitlrt@xxxxxxxxx>
    Closes: https://lore.kernel.org/bpf/CAK55_s6do7C+DVwbwY_7nKfUz0YLDoiA1v6X3Y9+p0sWzipFSA@xxxxxxxxxxxxxx/
    Acked-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
    Signed-off-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20240822080124.2995724-2-eddyz87@xxxxxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index fbf9721ba21b6..e0e4d4f490e87 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -8421,6 +8421,7 @@ int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
 	struct bpf_core_cand_list cands = {};
 	struct bpf_core_relo_res targ_res;
 	struct bpf_core_spec *specs;
+	const struct btf_type *type;
 	int err;
 
 	/* ~4k of temp memory necessary to convert LLVM spec like "0:1:0:5"
@@ -8430,6 +8431,13 @@ int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
 	if (!specs)
 		return -ENOMEM;
 
+	type = btf_type_by_id(ctx->btf, relo->type_id);
+	if (!type) {
+		bpf_log(ctx->log, "relo #%u: bad type id %u\n",
+			relo_idx, relo->type_id);
+		return -EINVAL;
+	}
+
 	if (need_cands) {
 		struct bpf_cand_cache *cc;
 		int i;