BPF List
 help / color / mirror / Atom feed
* [PATCH bpf] bpf: Validate BTF repeated field counts before expansion
@ 2026-06-05 23:43 Paul Moses
  2026-06-07  8:59 ` Kumar Kartikeya Dwivedi
  0 siblings, 1 reply; 6+ messages in thread
From: Paul Moses @ 2026-06-05 23:43 UTC (permalink / raw)
  To: martin.lau, ast, daniel, andrii, eddyz87, memxor, bpf
  Cc: song, yonghong.song, jolsa, houtao1, linux-kernel, Paul Moses,
	stable

btf_parse_struct_metas() walks user-supplied BTF during BPF_BTF_LOAD,
and btf_repeat_fields() expands repeatable fields from array elements
into the fixed BTF_FIELDS_MAX scratch array used by btf_parse_fields().

The remaining-capacity check performs the expanded field count calculation
in u32. A malformed BTF can wrap that calculation, causing the check to
pass even when the expanded field count exceeds the scratch array
capacity. The following memcpy() can then write past the end of the
array.

Use checked addition and multiplication before copying repeated fields
and reject impossible counts.

Fixes: 797d73ee232d ("bpf: Check the remaining info_cnt before repeating btf fields")
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moses <p@1g4.org>
---
 kernel/bpf/btf.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index a62d78581207..510aa32847da 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -3668,7 +3668,7 @@ static int btf_get_field_type(const struct btf *btf, const struct btf_type *var_
 static int btf_repeat_fields(struct btf_field_info *info, int info_cnt,
 			     u32 field_cnt, u32 repeat_cnt, u32 elem_size)
 {
-	u32 i, j;
+	u32 i, j, total_cnt, total_repeats;
 	u32 cur;
 
 	/* Ensure not repeating fields that should not be repeated. */
@@ -3686,10 +3686,9 @@ static int btf_repeat_fields(struct btf_field_info *info, int info_cnt,
 		}
 	}
 
-	/* The type of struct size or variable size is u32,
-	 * so the multiplication will not overflow.
-	 */
-	if (field_cnt * (repeat_cnt + 1) > info_cnt)
+	if (check_add_overflow(repeat_cnt, 1, &total_repeats) ||
+	    check_mul_overflow(field_cnt, total_repeats, &total_cnt) ||
+	    total_cnt > (u32)info_cnt)
 		return -E2BIG;
 
 	cur = field_cnt;
-- 
2.54.0



^ permalink raw reply related	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-06-07 17:53 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-05 23:43 [PATCH bpf] bpf: Validate BTF repeated field counts before expansion Paul Moses
2026-06-07  8:59 ` Kumar Kartikeya Dwivedi
2026-06-07 10:11   ` Paul Moses
2026-06-07 11:08     ` Kumar Kartikeya Dwivedi
2026-06-07 17:53       ` Paul Moses
2026-06-07 16:55   ` Alexei Starovoitov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox