Files
linux/include/linux
Martin KaFai Lau 96ea081ed5 bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing
There is a UAF report in the bpf_struct_ops when CONFIG_MODULES=n.
In particular, the report is on tcp_congestion_ops that has
a "struct module *owner" member.

For struct_ops that has a "struct module *owner" member,
it can be extended either by the regular kernel module or
by the bpf_struct_ops. bpf_try_module_get() will be used
to do the refcounting and different refcount is done
based on the owner pointer. When CONFIG_MODULES=n,
the btf_id of the "struct module" is missing:

WARN: resolve_btfids: unresolved symbol module

Thus, the bpf_try_module_get() cannot do the correct refcounting.

Not all subsystem's struct_ops requires the "struct module *owner" member.
e.g. the recent sched_ext_ops.

This patch is to disable bpf_struct_ops registration if
the struct_ops has the "struct module *" member and the
"struct module" btf_id is missing. The btf_type_is_fwd() helper
is moved to the btf.h header file for this test.

This has happened since the beginning of bpf_struct_ops which has gone
through many changes. The Fixes tag is set to a recent commit that this
patch can apply cleanly. Considering CONFIG_MODULES=n is not
common and the age of the issue, targeting for bpf-next also.

Fixes: 1611603537 ("bpf: Create argument information for nullable arguments.")
Reported-by: Robert Morris <rtm@csail.mit.edu>
Closes: https://lore.kernel.org/bpf/74665.1733669976@localhost/
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Tested-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20241220201818.127152-1-martin.lau@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-01-03 10:16:46 -08:00
..
2024-10-22 15:54:11 +02:00
2024-10-11 14:34:11 -04:00
2024-10-13 17:16:57 +02:00
2024-10-11 14:37:29 +05:30
2024-10-14 23:27:57 +05:30
2024-11-11 10:45:03 +01:00
2024-10-09 15:42:48 +01:00
2024-08-28 06:53:58 -07:00
2024-11-07 14:38:07 -08:00
2024-10-14 18:33:04 -07:00
2024-07-08 01:51:05 -06:00
2024-09-03 21:15:36 -07:00
2024-06-24 18:29:20 +02:00
2024-06-11 12:57:49 -05:00
2024-11-05 13:32:21 +01:00
2024-10-22 11:16:56 +02:00
2024-10-19 14:16:45 +02:00
2024-10-01 17:01:40 +02:00
2024-11-09 14:55:33 +01:00
2024-11-28 14:49:28 +01:00
2024-08-29 10:39:37 +02:00
2024-11-24 17:05:27 -08:00
2024-07-31 13:49:48 +01:00
2024-08-08 17:15:02 +02:00
2024-10-16 21:56:59 +02:00
2024-06-24 22:24:56 -07:00
2024-10-30 19:47:20 +01:00
2024-09-03 21:15:46 -07:00
2024-09-20 18:28:26 +03:00
2024-09-01 20:26:03 -07:00
2024-11-05 16:56:26 -08:00
2024-07-03 19:30:23 -07:00
2024-10-14 16:33:24 -05:00
2024-08-11 17:04:29 +01:00
2024-07-31 09:57:18 -07:00
2024-07-28 16:47:51 -06:00
2024-09-23 15:03:30 -04:00
2024-06-24 22:25:02 -07:00
2024-11-05 16:56:26 -08:00
2024-08-30 08:22:38 +02:00
2024-11-16 10:09:30 -06:00
2024-10-02 16:23:10 -05:00
2024-11-05 12:55:38 +01:00
2024-09-11 20:44:31 -07:00
2024-09-11 20:44:32 -07:00
2024-11-30 22:41:35 -05:00
2024-11-11 00:26:44 -08:00
2024-07-10 07:59:03 +02:00
2024-11-06 12:59:44 -05:00
2024-10-02 16:53:38 +02:00
2024-08-06 13:42:40 +02:00
2024-11-18 11:56:21 +00:00
2024-09-12 12:20:39 +02:00
2024-06-24 18:16:44 +01:00
2024-11-06 12:59:44 -05:00