From: Jeongjun Park Date: Sat, 31 Aug 2024 05:47:02 +0000 (+0900) Subject: bpf: add check for invalid name in btf_name_valid_section() X-Git-Tag: v6.11-rc7~25^2^2~1 X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=bb6705c3f93bed2af03d43691743d4c43e3c8e6f;p=linux-block.git bpf: add check for invalid name in btf_name_valid_section() If the length of the name string is 1 and the value of name[0] is NULL byte, an OOB vulnerability occurs in btf_name_valid_section() and the return value is true, so the invalid name passes the check. To solve this, you need to check if the first position is NULL byte and if the first character is printable. Suggested-by: Eduard Zingerman Fixes: bd70a8fb7ca4 ("bpf: Allow all printable characters in BTF DATASEC names") Signed-off-by: Jeongjun Park Link: https://lore.kernel.org/r/20240831054702.364455-1-aha310510@gmail.com Signed-off-by: Alexei Starovoitov Acked-by: Eduard Zingerman --- diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index e3377dd61f7e..a4e4f8d43ecf 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -823,9 +823,11 @@ static bool btf_name_valid_section(const struct btf *btf, u32 offset) const char *src = btf_str_by_offset(btf, offset); const char *src_limit; + if (!*src) + return false; + /* set a limit on identifier length */ src_limit = src + KSYM_NAME_LEN; - src++; while (*src && src < src_limit) { if (!isprint(*src)) return false;