bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing #4819
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![kernel-patches-daemon-bpf-rc[bot]](https://avatars.githubusercontent.com/u/70728002?s=60&v=4){kind=small}
|
Upstream branch: c5d2bac |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
a16555e to
5b81b0c
Compare
|
Upstream branch: 9468f39 |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/920022=>bpf-next
branch
from
889e32b to
6ca4ffe
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
5b81b0c to
70e482f
Compare
|
Upstream branch: 654a338 |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/920022=>bpf-next
branch
from
6ca4ffe to
3c03ab4
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
70e482f to
9e790c7
Compare
|
Upstream branch: dfa94ce |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/920022=>bpf-next
branch
from
3c03ab4 to
791b013
Compare
…le btf_id is missing There is a UAF report in the bpf_struct_ops when CONFIG_MODULES=n. In particular, the report is on tcp_congestion_ops that has a "struct module *owner" member. For struct_ops that has a "struct module *owner" member, it can be extended either by the regular kernel module or by the bpf_struct_ops. bpf_try_module_get() will be used to do the refcounting and different refcount is done based on the owner pointer. When CONFIG_MODULES=n, the btf_id of the "struct module" is missing: WARN: resolve_btfids: unresolved symbol module Thus, the bpf_try_module_get() cannot do the correct refcounting. Not all subsystem's struct_ops requires the "struct module *owner" member. e.g. the recent sched_ext_ops. This patch is to disable bpf_struct_ops registration if the struct_ops has the "struct module *" member and the "struct module" btf_id is missing. The btf_type_is_fwd() helper is moved to the btf.h header file for this test. This has happened since the beginning of bpf_struct_ops which has gone through many changes. The Fixes tag is set to a recent commit that this patch can apply cleanly. Considering CONFIG_MODULES=n is not common and the age of the issue, targeting for bpf-next also. Fixes: 1611603 ("bpf: Create argument information for nullable arguments.") Reported-by: Robert Morris <[email protected]> Closes: https://lore.kernel.org/bpf/74665.1733669976@localhost/ Signed-off-by: Martin KaFai Lau <[email protected]> Tested-by: Eduard Zingerman <[email protected]> Acked-by: Eduard Zingerman <[email protected]>
|
Upstream branch: dfa94ce |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/920022=>bpf-next
branch
from
791b013 to
5d54c42
Compare
|
At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=920022 irrelevant now. Closing PR. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pull request for series with
subject: bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing
version: 1
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=920022