mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Arnaldo Carvalho de Melo
5ebf4137d2
Several functions cast bpf_prog_info fields (jited_ksyms,
jited_func_lens, jited_prog_insns) from u64 to pointers and
dereference them. These fields are only valid pointers if
bpil_offs_to_addr() converted their file offsets to addresses, which
only happens when the corresponding PERF_BPIL_* bits are set in
info_linear->arrays.
A crafted perf.data can leave these bits unset while setting non-zero
counts and offset values, causing the functions to dereference raw file
offsets as pointers.
Add array bitmask validation to all perf.data processing paths:
- __bpf_event__print_bpf_prog_info(): check JITED_KSYMS and
JITED_FUNC_LENS (changed to take struct perf_bpil *)
- machine__process_bpf_event_load(): check JITED_KSYMS
- bpf_read(): check JITED_INSNS before memcpy from jited_prog_insns
- dso__disassemble_filename(): check JITED_INSNS before returning
jited_prog_insns pointer
Fixes: f8dfeae009 ("perf bpf: Show more BPF program info in print_bpf_prog_info()")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Song Liu <songliubraving@fb.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
74 lines
1.7 KiB
C
74 lines
1.7 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __PERF_BPF_EVENT_H
|
|
#define __PERF_BPF_EVENT_H
|
|
|
|
#include <linux/compiler.h>
|
|
#include <linux/rbtree.h>
|
|
#include <api/fd/array.h>
|
|
#include <stdio.h>
|
|
|
|
struct bpf_prog_info;
|
|
struct machine;
|
|
union perf_event;
|
|
struct perf_env;
|
|
struct perf_sample;
|
|
struct perf_session;
|
|
struct record_opts;
|
|
struct evlist;
|
|
struct target;
|
|
|
|
struct bpf_metadata {
|
|
union perf_event *event;
|
|
char **prog_names;
|
|
__u64 nr_prog_names;
|
|
};
|
|
|
|
struct bpf_prog_info_node {
|
|
struct perf_bpil *info_linear;
|
|
struct bpf_metadata *metadata;
|
|
struct rb_node rb_node;
|
|
};
|
|
|
|
struct btf_node {
|
|
struct rb_node rb_node;
|
|
u32 id;
|
|
u32 data_size;
|
|
char data[];
|
|
};
|
|
|
|
#ifdef HAVE_LIBBPF_SUPPORT
|
|
int machine__process_bpf(struct machine *machine, union perf_event *event,
|
|
struct perf_sample *sample);
|
|
int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env);
|
|
void __bpf_event__print_bpf_prog_info(struct perf_bpil *info_linear,
|
|
struct perf_env *env,
|
|
FILE *fp);
|
|
void bpf_metadata_free(struct bpf_metadata *metadata);
|
|
#else
|
|
static inline int machine__process_bpf(struct machine *machine __maybe_unused,
|
|
union perf_event *event __maybe_unused,
|
|
struct perf_sample *sample __maybe_unused)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int evlist__add_bpf_sb_event(struct evlist *evlist __maybe_unused,
|
|
struct perf_env *env __maybe_unused)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void __bpf_event__print_bpf_prog_info(struct perf_bpil *info_linear __maybe_unused,
|
|
struct perf_env *env __maybe_unused,
|
|
FILE *fp __maybe_unused)
|
|
{
|
|
|
|
}
|
|
|
|
static inline void bpf_metadata_free(struct bpf_metadata *metadata __maybe_unused)
|
|
{
|
|
|
|
}
|
|
#endif // HAVE_LIBBPF_SUPPORT
|
|
#endif
|