leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libbpf: Fix using invalidated memory in bpf_linker

Browse Source 
add_dst_sec() can invalidate bpf_linker's section index making
dst_symtab pointer pointing into unallocated memory. Reinitialize
dst_symtab pointer on each iteration to make sure it's always valid.

Fixes: faf6ed321c ("libbpf: Add BPF static linker APIs")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20211124002325.1737739-7-andrii@kernel.org
This commit is contained in:
Andrii Nakryiko
2021-11-23 16:23:18 -08:00
committed by Daniel Borkmann
parent 8cb125566c
commit 593835377f
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
tools/lib/bpf/linker.c
View File

@@ -2000,7 +2000,7 @@ add_sym:
static int linker_append_elf_relos(struct bpf_linker *linker, struct src_obj *obj) static int linker_append_elf_relos(struct bpf_linker *linker, struct src_obj *obj)
{ {
struct src_sec *src_symtab = &obj->secs[obj->symtab_sec_idx]; struct src_sec *src_symtab = &obj->secs[obj->symtab_sec_idx];
struct dst_sec *dst_symtab = &linker->secs[linker->symtab_sec_idx]; struct dst_sec *dst_symtab;
int i, err; int i, err;
for (i = 1; i < obj->sec_cnt; i++) { for (i = 1; i < obj->sec_cnt; i++) {
@@ -2033,6 +2033,9 @@ static int linker_append_elf_relos(struct bpf_linker *linker, struct src_obj *ob
return -1; return -1;
} }
/* add_dst_sec() above could have invalidated linker->secs */
dst_symtab = &linker->secs[linker->symtab_sec_idx];
/* shdr->sh_link points to SYMTAB */ /* shdr->sh_link points to SYMTAB */
dst_sec->shdr->sh_link = linker->symtab_sec_idx; dst_sec->shdr->sh_link = linker->symtab_sec_idx;