Commit bb6705c3 authored by Jeongjun Park's avatar Jeongjun Park Committed by Alexei Starovoitov

bpf: add check for invalid name in btf_name_valid_section()

If the length of the name string is 1 and the value of name[0] is NULL
byte, an OOB vulnerability occurs in btf_name_valid_section() and the
return value is true, so the invalid name passes the check.

To solve this, you need to check if the first position is NULL byte and
if the first character is printable.
Suggested-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Fixes: bd70a8fb ("bpf: Allow all printable characters in BTF DATASEC names")
Signed-off-by: default avatarJeongjun Park <aha310510@gmail.com>
Link: https://lore.kernel.org/r/20240831054702.364455-1-aha310510@gmail.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
parent b408473e
......@@ -823,9 +823,11 @@ static bool btf_name_valid_section(const struct btf *btf, u32 offset)
const char *src = btf_str_by_offset(btf, offset);
const char *src_limit;
if (!*src)
return false;
/* set a limit on identifier length */
src_limit = src + KSYM_NAME_LEN;
src++;
while (*src && src < src_limit) {
if (!isprint(*src))
return false;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment