kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
No description
1,156,968 commits 116 branches 5,798 tags 5.6 GiB
  • C 96.9%
  • Assembly 0.9%
  • Rust 0.6%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Lorenz Bauer 1f11641107 btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR 
[ Upstream commit 9b459804ff ]

btf_datasec_resolve contains a bug that causes the following BTF
to fail loading:

    [1] DATASEC a size=2 vlen=2
        type_id=4 offset=0 size=1
        type_id=7 offset=1 size=1
    [2] INT (anon) size=1 bits_offset=0 nr_bits=8 encoding=(none)
    [3] PTR (anon) type_id=2
    [4] VAR a type_id=3 linkage=0
    [5] INT (anon) size=1 bits_offset=0 nr_bits=8 encoding=(none)
    [6] TYPEDEF td type_id=5
    [7] VAR b type_id=6 linkage=0

This error message is printed during btf_check_all_types:

    [1] DATASEC a size=2 vlen=2
        type_id=7 offset=1 size=1 Invalid type

By tracing btf_*_resolve we can pinpoint the problem:

    btf_datasec_resolve(depth: 1, type_id: 1, mode: RESOLVE_TBD) = 0
        btf_var_resolve(depth: 2, type_id: 4, mode: RESOLVE_TBD) = 0
            btf_ptr_resolve(depth: 3, type_id: 3, mode: RESOLVE_PTR) = 0
        btf_var_resolve(depth: 2, type_id: 4, mode: RESOLVE_PTR) = 0
    btf_datasec_resolve(depth: 1, type_id: 1, mode: RESOLVE_PTR) = -22

The last invocation of btf_datasec_resolve should invoke btf_var_resolve
by means of env_stack_push, instead it returns EINVAL. The reason is that
env_stack_push is never executed for the second VAR.

    if (!env_type_is_resolve_sink(env, var_type) &&
        !env_type_is_resolved(env, var_type_id)) {
        env_stack_set_next_member(env, i + 1);
        return env_stack_push(env, var_type, var_type_id);
    }

env_type_is_resolve_sink() changes its behaviour based on resolve_mode.
For RESOLVE_PTR, we can simplify the if condition to the following:

    (btf_type_is_modifier() || btf_type_is_ptr) && !env_type_is_resolved()

Since we're dealing with a VAR the clause evaluates to false. This is
not sufficient to trigger the bug however. The log output and EINVAL
are only generated if btf_type_id_size() fails.

    if (!btf_type_id_size(btf, &type_id, &type_size)) {
        btf_verifier_log_vsi(env, v->t, vsi, "Invalid type");
        return -EINVAL;
    }

Most types are sized, so for example a VAR referring to an INT is not a
problem. The bug is only triggered if a VAR points at a modifier. Since
we skipped btf_var_resolve that modifier was also never resolved, which
means that btf_resolved_type_id returns 0 aka VOID for the modifier.
This in turn causes btf_type_id_size to return NULL, triggering EINVAL.

To summarise, the following conditions are necessary:

- VAR pointing at PTR, STRUCT, UNION or ARRAY
- Followed by a VAR pointing at TYPEDEF, VOLATILE, CONST, RESTRICT or
  TYPE_TAG

The fix is to reset resolve_mode to RESOLVE_TBD before attempting to
resolve a VAR from a DATASEC.

Fixes: 1dc9285184 ("bpf: kernel side support for BTF Var and DataSec")
Signed-off-by: Lorenz Bauer <lmb@isovalent.com>
Link: https://lore.kernel.org/r/20230306112138.155352-2-lmb@isovalent.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-03-17 08:57:57 +01:00
arch m68k: mm: Move initrd phys_to_virt handling after paging_init() 2023-03-17 08:57:56 +01:00
block block: fix scan partition for exclusively open device again 2023-03-17 08:57:50 +01:00
certs certs: Fix build error when PKCS#11 URI contains semicolon 2023-01-31 17:53:01 +09:00
crypto crypto: rsa-pkcs1pad - Use akcipher_request_complete 2023-03-10 09:28:18 +01:00
Documentation usb: gadget: uvc: Make bSourceID read/write 2023-03-11 13:50:44 +01:00
drivers bnxt_en: Avoid order-5 memory allocation for TPA data 2023-03-17 08:57:56 +01:00
fs btrfs: fix extent map logging bit not cleared for split maps after dropping range 2023-03-17 08:57:56 +01:00
include netfilter: tproxy: fix deadlock due to missing BH disable 2023-03-17 08:57:56 +01:00
init Kbuild fixes for v6.2 (3rd) 2023-01-21 10:56:37 -08:00
io_uring io_uring/uring_cmd: ensure that device supports IOPOLL 2023-03-17 08:57:45 +01:00
ipc Non-MM patches for 6.2-rc1. 2022-12-12 17:28:58 -08:00
kernel btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR 2023-03-17 08:57:57 +01:00
lib cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG 2023-03-10 09:29:06 +01:00
LICENSES LICENSES: Add the copyleft-next-0.3.1 license 2022-11-08 15:44:01 +01:00
mm memory tier: release the new_memtier in find_create_memory_tier() 2023-03-10 09:29:50 +01:00
net bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES 2023-03-17 08:57:56 +01:00
rust rust: print: avoid evaluating arguments in pr_* macros in unsafe blocks 2023-01-16 00:54:35 +01:00
samples ftrace: Export ftrace_free_filter() to modules 2023-01-24 11:20:58 -05:00
scripts gcc-plugins: drop -std=gnu++11 to fix GCC 13 build 2023-03-10 09:29:11 +01:00
security ima: Align ima_file_mmap() parameters with mmap_file LSM hook 2023-03-10 09:29:36 +01:00
sound ASoC: mediatek: mt8195: add missing initialization 2023-03-11 13:50:37 +01:00
tools bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES 2023-03-17 08:57:56 +01:00
usr usr/gen_init_cpio.c: remove unnecessary -1 values from int file 2022-10-03 14:21:44 -07:00
virt KVM: Register /dev/kvm as the _very_ last thing during initialization 2023-03-10 09:29:33 +01:00
.clang-format iommufd for 6.2 2022-12-14 09:15:43 -08:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore get_maintainer: add Alan to .get_maintainer.ignore 2022-08-20 15:17:44 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore .gitignore: ignore *.rpm 2022-12-30 17:22:14 +09:00
.mailmap 12 hotfixes, mostly against mm/. Five of these fixes are cc:stable. 2023-02-13 14:09:20 -08:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: update SCTP maintainers 2023-02-02 11:35:33 -08:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS audit: update the mailing list in MAINTAINERS 2023-02-25 11:13:29 +01:00
Makefile Linux 6.2.6 2023-03-13 10:26:43 +01:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.