]> git.baikalelectronics.ru Git - kernel.git/commit
bpf: Limit maximum modifier chain length in btf_check_type_tags
authorKumar Kartikeya Dwivedi <memxor@gmail.com>
Wed, 15 Jun 2022 04:21:51 +0000 (09:51 +0530)
committerDaniel Borkmann <daniel@iogearbox.net>
Wed, 15 Jun 2022 17:32:12 +0000 (19:32 +0200)
commit28718dd8fc61d3d00d0ab260a6302010a77cc1b1
treeb585239a187d9415698d6841b05a1b8263a36153
parent70337a679a7060837febce1eb339e40f99dfcc00
bpf: Limit maximum modifier chain length in btf_check_type_tags

On processing a module BTF of module built for an older kernel, we might
sometimes find that some type points to itself forming a loop. If such a
type is a modifier, btf_check_type_tags's while loop following modifier
chain will be caught in an infinite loop.

Fix this by defining a maximum chain length and bailing out if we spin
any longer than that.

Fixes: 28abb063048c ("bpf: Ensure type tags precede modifiers in BTF")
Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20220615042151.2266537-1-memxor@gmail.com
kernel/bpf/btf.c