]> git.hungrycats.org Git - linux/commit
libbpf: Fix bpf_object__open_skeleton()'s mishandling of options
authorAndrii Nakryiko <andrii@kernel.org>
Tue, 27 Aug 2024 20:37:21 +0000 (13:37 -0700)
committerDaniel Borkmann <daniel@iogearbox.net>
Thu, 29 Aug 2024 15:47:27 +0000 (17:47 +0200)
commitc634d6f4e12d00c954410ba11db45799a8c77b5b
tree2c242c67614236070ef4dfd343737e9574a8e823
parent6db59c4935c9354f4c33fc63287d110317ca4d70
libbpf: Fix bpf_object__open_skeleton()'s mishandling of options

We do an ugly copying of options in bpf_object__open_skeleton() just to
be able to set object name from skeleton's recorded name (while still
allowing user to override it through opts->object_name).

This is not just ugly, but it also is broken due to memcpy() that
doesn't take into account potential skel_opts' and user-provided opts'
sizes differences due to backward and forward compatibility. This leads
to copying over extra bytes and then failing to validate options
properly. It could, technically, lead also to SIGSEGV, if we are unlucky.

So just get rid of that memory copy completely and instead pass
default object name into bpf_object_open() directly, simplifying all
this significantly. The rule now is that obj_name should be non-NULL for
bpf_object_open() when called with in-memory buffer, so validate that
explicitly as well.

We adopt bpf_object__open_mem() to this as well and generate default
name (based on buffer memory address and size) outside of bpf_object_open().

Fixes: d66562fba1ce ("libbpf: Add BPF object skeleton support")
Reported-by: Daniel Müller <deso@posteo.net>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Daniel Müller <deso@posteo.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20240827203721.1145494-1-andrii@kernel.org
tools/lib/bpf/libbpf.c