Messages in this thread | | | From | Song Liu <> | Date | Mon, 8 Oct 2018 13:51:09 -0700 | Subject | Re: [PATCH] bpf: btf: Fix a missing check bug |
| |
On Sun, Oct 7, 2018 at 1:26 PM Wenwen Wang <wang6495@umn.edu> wrote: > > In btf_parse_hdr(), the length of the btf data header is firstly copied > from the user space to 'hdr_len' and checked to see whether it is larger > than 'btf_data_size'. If yes, an error code EINVAL is returned. Otherwise, > the whole header is copied again from the user space to 'btf->hdr'. > However, after the second copy, there is no check between > 'btf->hdr->hdr_len' and 'hdr_len' to confirm that the two copies get the > same value. Given that the btf data is in the user space, a malicious user > can race to change the data between the two copies. By doing so, the user > can provide malicious data to the kernel and cause undefined behavior. > > This patch adds a necessary check after the second copy, to make sure > 'btf->hdr->hdr_len' has the same value as 'hdr_len'. Otherwise, an error > code EINVAL will be returned.
These two numbers are copied from same memory location, right? So I think this check is not necessary?
Thank, Song
> > Signed-off-by: Wenwen Wang <wang6495@umn.edu> > --- > kernel/bpf/btf.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c > index 2590700..7cce7db 100644 > --- a/kernel/bpf/btf.c > +++ b/kernel/bpf/btf.c > @@ -2114,6 +2114,9 @@ static int btf_parse_hdr(struct btf_verifier_env *env, void __user *btf_data, > > hdr = &btf->hdr; > > + if (hdr->hdr_len != hdr_len) > + return -EINVAL; > + > btf_verifier_log_hdr(env, btf_data_size); > > if (hdr->magic != BTF_MAGIC) { > -- > 2.7.4 >
| |