[PATCH bpf v3 0/2] bpf: reject negative CO-RE accessor indices

[Weiming Shi <bestswngs@gmail.com>]

bpf_core_parse_spec() parses CO-RE accessor strings with sscanf("%d"),
which accepts negative values.  The downstream bounds checks only test
the upper bound, so a negative index like -1 slips through, gets cast
to u32 0xffffffff in btf_member_bit_offset(), and crashes the kernel.

To clarify the kernel-side concern from v2 review:
tools/lib/bpf/relo_core.c is shared code -- the kernel compiles it
directly via kernel/bpf/relo_core.c (#include).  So the fix does
apply in the kernel's BPF_PROG_LOAD -> check_core_relo() ->
bpf_core_apply() -> bpf_core_parse_spec() path.

v3: added selftest (patch 2/2)
v2: fix typo Signed-off-by tag (missing leading 'S')

Weiming Shi (2):
  bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
  selftests/bpf: add test for negative CO-RE accessor index rejection

 tools/lib/bpf/relo_core.c                     |  2 +
 .../selftests/bpf/prog_tests/core_reloc_raw.c | 94 +++++++++++++++++++
 2 files changed, 96 insertions(+)

-- 
2.43.0