mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
samples/bpf: syscall_tp_user: Fix array out-of-bound access
Commit06744f2469
("samples/bpf: Add openat2() enter/exit tracepoint to syscall_tp sample") added two more eBPF programs to support the openat2() syscall. However, it did not increase the size of the array that holds the corresponding bpf_links. This leads to an out-of-bound access on that array in the bpf_object__for_each_program loop and could corrupt other variables on the stack. On our testing QEMU, it corrupts the map1_fds array and causes the sample to fail: # ./syscall_tp prog #0: map ids 4 5 verify map:4 val: 5 map_lookup failed: Bad file descriptor Dynamically allocate the array based on the number of programs reported by libbpf to prevent similar inconsistencies in the future Fixes:06744f2469
("samples/bpf: Add openat2() enter/exit tracepoint to syscall_tp sample") Signed-off-by: Jinghao Jia <jinghao@linux.ibm.com> Signed-off-by: Ruowen Qin <ruowenq2@illinois.edu> Signed-off-by: Jinghao Jia <jinghao7@illinois.edu> Link: https://lore.kernel.org/r/20230917214220.637721-4-jinghao7@illinois.edu Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
parent
0ee352fe0d
commit
9220c3ef6f
|
@ -48,7 +48,7 @@ static void verify_map(int map_id)
|
|||
static int test(char *filename, int nr_tests)
|
||||
{
|
||||
int map0_fds[nr_tests], map1_fds[nr_tests], fd, i, j = 0;
|
||||
struct bpf_link *links[nr_tests * 4];
|
||||
struct bpf_link **links = NULL;
|
||||
struct bpf_object *objs[nr_tests];
|
||||
struct bpf_program *prog;
|
||||
|
||||
|
@ -60,6 +60,19 @@ static int test(char *filename, int nr_tests)
|
|||
goto cleanup;
|
||||
}
|
||||
|
||||
/* One-time initialization */
|
||||
if (!links) {
|
||||
int nr_progs = 0;
|
||||
|
||||
bpf_object__for_each_program(prog, objs[i])
|
||||
nr_progs += 1;
|
||||
|
||||
links = calloc(nr_progs * nr_tests, sizeof(struct bpf_link *));
|
||||
|
||||
if (!links)
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
/* load BPF program */
|
||||
if (bpf_object__load(objs[i])) {
|
||||
fprintf(stderr, "loading BPF object file failed\n");
|
||||
|
@ -107,8 +120,12 @@ static int test(char *filename, int nr_tests)
|
|||
}
|
||||
|
||||
cleanup:
|
||||
for (j--; j >= 0; j--)
|
||||
bpf_link__destroy(links[j]);
|
||||
if (links) {
|
||||
for (j--; j >= 0; j--)
|
||||
bpf_link__destroy(links[j]);
|
||||
|
||||
free(links);
|
||||
}
|
||||
|
||||
for (i--; i >= 0; i--)
|
||||
bpf_object__close(objs[i]);
|
||||
|
|
Loading…
Reference in a new issue