mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-08-28 23:55:20 -04:00
171609f047
Add a test case to reproduce the out-of-bounds read issue when copying from a cgroup storage map to a pcpu map with a value_size not rounded up to 8 bytes. The test creates: 1. A CGROUP_STORAGE map with 4-byte value (not 8-byte aligned) 2. A LRU_PERCPU_HASH map with 4-byte value (same size) When a socket is created in the cgroup, the BPF program triggers bpf_map_update_elem() which calls copy_map_value_long(). This function rounds up the copy size to 8 bytes, but the cgroup storage buffer is only 4 bytes, causing an OOB read (before the fix). Signed-off-by: Lang Xu <xulang@uniontech.com> Link: https://lore.kernel.org/r/D63BF0DBFF1EA122+20260402074236.2187154-2-xulang@uniontech.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
68 lines
1.6 KiB
C
68 lines
1.6 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
#include <linux/bpf.h>
|
|
#include <bpf/bpf_helpers.h>
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_CGROUP_STORAGE);
|
|
__type(key, struct bpf_cgroup_storage_key);
|
|
__type(value, __u64);
|
|
} cgroup_storage SEC(".maps");
|
|
|
|
SEC("cgroup_skb/egress")
|
|
int bpf_prog(struct __sk_buff *skb)
|
|
{
|
|
__u64 *counter;
|
|
|
|
counter = bpf_get_local_storage(&cgroup_storage, 0);
|
|
__sync_fetch_and_add(counter, 1);
|
|
|
|
/* Drop one out of every two packets */
|
|
return (*counter & 1);
|
|
}
|
|
|
|
/* Maps for OOB test */
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_CGROUP_STORAGE);
|
|
__type(key, struct bpf_cgroup_storage_key);
|
|
__type(value, __u32); /* 4-byte value - not 8-byte aligned */
|
|
} cgroup_storage_oob SEC(".maps");
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_LRU_PERCPU_HASH);
|
|
__uint(max_entries, 1);
|
|
__type(key, __u32);
|
|
__type(value, __u32); /* 4-byte value - same as cgroup storage */
|
|
} lru_map SEC(".maps");
|
|
|
|
SEC("cgroup/sock_create")
|
|
int trigger_oob(struct bpf_sock *sk)
|
|
{
|
|
__u32 key = 0;
|
|
__u32 *cgroup_val;
|
|
__u32 value = 0x12345678;
|
|
|
|
/* Get cgroup storage value */
|
|
cgroup_val = bpf_get_local_storage(&cgroup_storage_oob, 0);
|
|
if (!cgroup_val)
|
|
return 0;
|
|
|
|
/* Initialize cgroup storage */
|
|
*cgroup_val = value;
|
|
|
|
/* This triggers the OOB read:
|
|
* bpf_map_update_elem() -> htab_map_update_elem() ->
|
|
* pcpu_init_value() -> copy_map_value_long() ->
|
|
* bpf_obj_memcpy(..., long_memcpy=true) ->
|
|
* bpf_long_memcpy(dst, src, round_up(4, 8))
|
|
*
|
|
* The copy size is rounded up to 8 bytes, but cgroup_val
|
|
* points to a 4-byte buffer, causing a 4-byte OOB read.
|
|
*/
|
|
bpf_map_update_elem(&lru_map, &key, cgroup_val, BPF_ANY);
|
|
|
|
return 1;
|
|
}
|
|
|
|
char _license[] SEC("license") = "GPL";
|