From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A67E6E6B278 for ; Fri, 1 Nov 2024 13:54:10 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 313636B00AD; Fri, 1 Nov 2024 09:54:10 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 29A456B00AE; Fri, 1 Nov 2024 09:54:10 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0EE0A6B00AF; Fri, 1 Nov 2024 09:54:10 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id DB09F6B00AD for ; Fri, 1 Nov 2024 09:54:09 -0400 (EDT) Received: from smtpin10.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 94C661C61EB for ; Fri, 1 Nov 2024 13:54:09 +0000 (UTC) X-FDA: 82737669336.10.318D420 Received: from mail-lf1-f43.google.com (mail-lf1-f43.google.com [209.85.167.43]) by imf22.hostedemail.com (Postfix) with ESMTP id A048AC001D for ; Fri, 1 Nov 2024 13:53:32 +0000 (UTC) Authentication-Results: imf22.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=c1gHYeBr; spf=pass (imf22.hostedemail.com: domain of olsajiri@gmail.com designates 209.85.167.43 as permitted sender) smtp.mailfrom=olsajiri@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1730469031; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=4pGgo/9SWmpICBmZTu9VKnqkzR9z4AL22vX7/lGLfvM=; b=rxt7trXVy1w1sSkpWFg2kU8n/8oG7s0mS8mYIp0nFee/h3tPF9ZLfmJSx7g73m3MrdBn3I ZowZOLjSF9o2uRY/OWn5I/AYFD7KAEo0mYFbjoSUcAecXVpPDcMJpRI7baUMmswnjk1Pn7 htHC7Snz2eDsbwzLhnUfZfLHTeWa5Vk= ARC-Authentication-Results: i=1; imf22.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=c1gHYeBr; spf=pass (imf22.hostedemail.com: domain of olsajiri@gmail.com designates 209.85.167.43 as permitted sender) smtp.mailfrom=olsajiri@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1730469031; a=rsa-sha256; cv=none; b=SIIkfKnXdwRThZh4BePk92O+miDr9CJI5mht+fZVZIvAKh7afMGzaVn21lWKkw+cbmDcmi nUVj+09Kee0DE3L3umrlAGDUATiW76hwOamDgyXgk/uafi7cBPodgi7uqMwZl1VvY61QxG 2u2HXoFV1LiO4pr667hiOa9gv5brB6E= Received: by mail-lf1-f43.google.com with SMTP id 2adb3069b0e04-539f6e1f756so2128155e87.0 for ; Fri, 01 Nov 2024 06:54:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1730469246; x=1731074046; darn=kvack.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:date:from:from:to:cc:subject:date:message-id:reply-to; bh=4pGgo/9SWmpICBmZTu9VKnqkzR9z4AL22vX7/lGLfvM=; b=c1gHYeBraTjwPltmlyuIGUS/pW24HqGbdGKOZx8q+90mCsDIOBitlosWk9xpQiNgJa zTfoVHGUNw12UgIOX71vzVvlErm5JKhKxcvO+tG3K9iTI1ETOmOVWZ+WeQEIyHyeyxZD VNdgO+dnuVFaLcE/oTu5Cm3JwLmV0tKuGyPk/59F8nEhWClhJD2QRK2PoS+9iklHHXmE rJytXVnuqyjFAXK9iu8oFHosIOwfCjf6ByqE3s4tVNycvZ1DLX/YnpupMI0FAl/ya0Fj BndsnclxFPngZqR2xtbA9d8raEesEM3Un5k5eBAtidjxn2fVm78PeezTCla1A6zc8RVd 2B2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1730469246; x=1731074046; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:date:from:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=4pGgo/9SWmpICBmZTu9VKnqkzR9z4AL22vX7/lGLfvM=; b=YgjjQLdzVo6LIr+LIzaWTAr8MZKNPLPcCchFH29EczPOOVy1sok6nAkfnyL2ODu2mN wixGssLH4tcMAoMO5mX8+ulKyruSzQ98I4ThoVLiDFQ2YuQjXa5NXEpWpLr4g+M6N6rQ SWeO8i9LplAOCPOTUvzxd4ONW+VdFDxBIL+wV9oS4cUb3KYjvEGYEUncJfQUGRkvzaCh OUxfLLNc6eYYbBv8P5hCiFbVSymsfIfqEAZonjoNKdN5Ei6wLSes3EdEBxm0Jhzf50GU 7AAo00wqWAjhB88EaMdSHp0e9djBo2bMm41eh0qLF65ChbaJD5/TCPoI3yXQcyZQ34ot CQiw== X-Forwarded-Encrypted: i=1; AJvYcCVtuDoKRsn/YwX5VLcnL4ZvTbdIEdBz8oBQzdj4n6UUEtzA/sQwHjTIRnP/6cLWUQOhZCt/4Bm3Rw==@kvack.org X-Gm-Message-State: AOJu0YzstSJfj7yMXdNMb4d6hIXwua+PMkOL0zJLS4mPlLRzZesyICOw xtvgJV2vYGzRBAgBdCJUcMQE5kc+eLkDbUAYTEe4d3uN5PqCvAe7WUTF1w== X-Google-Smtp-Source: AGHT+IGzjkJaelXORK7vXOahgcQjA06uA3RsLsk5cKEhjwvSmF1MIC806x8nvpjeQ2fhpQ9G8ffYog== X-Received: by 2002:a05:6512:3d0c:b0:539:f8da:b466 with SMTP id 2adb3069b0e04-53b348c37cemr12134730e87.11.1730469245787; Fri, 01 Nov 2024 06:54:05 -0700 (PDT) Received: from krava (2001-1ae9-1c2-4c00-726e-c10f-8833-ff22.ip6.tmcz.cz. [2001:1ae9:1c2:4c00:726e:c10f:8833:ff22]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-381c10b7b32sm5318083f8f.18.2024.11.01.06.54.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 01 Nov 2024 06:54:05 -0700 (PDT) From: Jiri Olsa X-Google-Original-From: Jiri Olsa Date: Fri, 1 Nov 2024 14:54:03 +0100 To: Andrii Nakryiko Cc: bpf@vger.kernel.org, linux-mm@kvack.org, akpm@linux-foundation.org, adobriyan@gmail.com, shakeel.butt@linux.dev, hannes@cmpxchg.org, ak@linux.intel.com, osandov@osandov.com, song@kernel.org, jannh@google.com, linux-fsdevel@vger.kernel.org, willy@infradead.org, stable@vger.kernel.org, Eduard Zingerman Subject: Re: [PATCH v7 bpf-next 01/10] lib/buildid: harden build ID parsing logic Message-ID: References: <20240829174232.3133883-1-andrii@kernel.org> <20240829174232.3133883-2-andrii@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240829174232.3133883-2-andrii@kernel.org> X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: A048AC001D X-Stat-Signature: a1a4pmr5bnqdhigbx85nd1n4b793my3e X-Rspam-User: X-HE-Tag: 1730469212-122293 X-HE-Meta: U2FsdGVkX19JL8EGao5jEDhKxDm+iuqYhQObcCjYCAyCiUAzRq1RNy0gAyVYhaf505d8/vGXTN9kRA9h1IJr8vi93PKMv+8ITFMCcx6Ez+jbFnf7v7Lwn0o+FJpQ744/0hX8y+uKkrITtuzXCgsTCSbKRk0YDw5tWDD+B8ZL3jtt5TrX2Of9u1AonHq833PusJnbeuryCKVJBQKfGGXKoFni04rr4guAvszvIGvgEgxQbMmKzeoi5Pfik+XTLk7SYuiRgM3F4hXGKh+rIcFcRilMV6Lf7RXYyg659vl9//k91h+SeCc9VjMN8gvSGqe8G7BWTIyvKH6QT641NhiAnXI6bLrcjnIgKCLX6TKm/CNx9mXCnG5/kuYvs0BSivEWBv3S1mA4oat+O85spIwuQLTMtthsBAuLYp20PJiC6bbDizXQaF5CkuPT4I9n8tw1y82aJmpv42heWxref7klb+TgQD+XWfHC7yGbojZ9V5L1iUDTpsdXlNOUyFlfJVKWxuKZLZ5dE4rYkbapBUfNJ5sy7DE9HH/YsclwhAojTXn62eMTP0r2fbuAd5U3oFPlb3COR4hH4x+j4mrVuwcU290u+51wuGU0tP1VU/2j/Ey4IhE1NyxYpYPY2kwO//LNai+lRrFWFDjruoOv+he2oiJjomq6ilAXfeDnxJigMqzXllJgGxFACw5AwJNrlDH8TGmFLCVmDMvisdWPJHP59UCntg7gYfCcdc4jDHTjGKL8/NfIGEFT53ReY0Vexn2Gt1Otj1CptO7N/DXgiB/3cellKwK5K0J8eVU0YXrwrFTK9vUPdh44WRczHm+NVoM+AQ55j0NuuefoqlKafn4S/BDVdAw5xoms6aAeFGBh7ZafERVQc+CDGuBcXO8KmgpywTY3vg5H54XzEoGD7Cdi76VfdVctnF3sDK2sabROVBhiiXF3qX1SUUzxLzLgUzHWCRZpSdZa1yvKqWUEHzG Pv8L1YjY vd2oVCnzKMcQC51MIWlf63cKh6jB6KEYPPmJghHd+JSit2pk/QwYVHkhcJ8/TIe16HwMp33VD1DmmHwvC7U2XrguROkv44LUpJe8vlC7L3qEmHg+rIHUQcqCtVT4K5IONmGs1T7NRUgfQfHO2tQAdDqRfHiyNoKHtvZWGnAOv0UKrvteNaeTK5QZFCb0qHavdtIZRFd2OR8csbXTMaNfdVziYtY8FtG9oRiZmKI6YMVaeYZdVHJ6hz9u8txteSRVEyQbTz3Jg6f5lgT3SpxcoFeEUD9VyEiibSILCNIR7zOmlCOF3mv/Ii/Y6b3GuttDN+d6S5PYAWSxutxsBEWvIrYozttB1X3Ixnx1IPb8EeVNHgqq9+ha8QbPQpZAqbLrojg5mpRdwm3DYywuJpigzaVgPbwghkLDUJ+8kxLcpYrtL3Y2DECd18TiYFNtVzK6kADAz0791uRC9sDXwS6crye4WQCT/0x6SOUUd X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, Aug 29, 2024 at 10:42:23AM -0700, Andrii Nakryiko wrote: > Harden build ID parsing logic, adding explicit READ_ONCE() where it's > important to have a consistent value read and validated just once. > > Also, as pointed out by Andi Kleen, we need to make sure that entire ELF > note is within a page bounds, so move the overflow check up and add an > extra note_size boundaries validation. > > Fixes tag below points to the code that moved this code into > lib/buildid.c, and then subsequently was used in perf subsystem, making > this code exposed to perf_event_open() users in v5.12+. > > Cc: stable@vger.kernel.org > Reviewed-by: Eduard Zingerman > Reviewed-by: Jann Horn > Suggested-by: Andi Kleen > Fixes: bd7525dacd7e ("bpf: Move stack_map_get_build_id into lib") > Signed-off-by: Andrii Nakryiko > --- > lib/buildid.c | 76 +++++++++++++++++++++++++++++---------------------- > 1 file changed, 44 insertions(+), 32 deletions(-) > > diff --git a/lib/buildid.c b/lib/buildid.c > index e02b5507418b..26007cc99a38 100644 > --- a/lib/buildid.c > +++ b/lib/buildid.c > @@ -18,31 +18,37 @@ static int parse_build_id_buf(unsigned char *build_id, > const void *note_start, > Elf32_Word note_size) > { > - Elf32_Word note_offs = 0, new_offs; > - > - while (note_offs + sizeof(Elf32_Nhdr) < note_size) { > - Elf32_Nhdr *nhdr = (Elf32_Nhdr *)(note_start + note_offs); > + const char note_name[] = "GNU"; > + const size_t note_name_sz = sizeof(note_name); > + u64 note_off = 0, new_off, name_sz, desc_sz; > + const char *data; > + > + while (note_off + sizeof(Elf32_Nhdr) < note_size && > + note_off + sizeof(Elf32_Nhdr) > note_off /* overflow */) { > + Elf32_Nhdr *nhdr = (Elf32_Nhdr *)(note_start + note_off); > + > + name_sz = READ_ONCE(nhdr->n_namesz); > + desc_sz = READ_ONCE(nhdr->n_descsz); > + > + new_off = note_off + sizeof(Elf32_Nhdr); > + if (check_add_overflow(new_off, ALIGN(name_sz, 4), &new_off) || > + check_add_overflow(new_off, ALIGN(desc_sz, 4), &new_off) || > + new_off > note_size) > + break; > > if (nhdr->n_type == BUILD_ID && > - nhdr->n_namesz == sizeof("GNU") && > - !strcmp((char *)(nhdr + 1), "GNU") && > - nhdr->n_descsz > 0 && > - nhdr->n_descsz <= BUILD_ID_SIZE_MAX) { > - memcpy(build_id, > - note_start + note_offs + > - ALIGN(sizeof("GNU"), 4) + sizeof(Elf32_Nhdr), > - nhdr->n_descsz); > - memset(build_id + nhdr->n_descsz, 0, > - BUILD_ID_SIZE_MAX - nhdr->n_descsz); > + name_sz == note_name_sz && > + memcmp(nhdr + 1, note_name, note_name_sz) == 0 && > + desc_sz > 0 && desc_sz <= BUILD_ID_SIZE_MAX) { > + data = note_start + note_off + ALIGN(note_name_sz, 4); > + memcpy(build_id, data, desc_sz); > + memset(build_id + desc_sz, 0, BUILD_ID_SIZE_MAX - desc_sz); > if (size) > - *size = nhdr->n_descsz; > + *size = desc_sz; > return 0; > } hi, this fix is causing stable kernels to return wrong build id, the change below seems to fix that (based on 6.6 stable) if we agree on the fix I'll send it to all affected stable trees jirka --- The parse_build_id_buf does not account Elf32_Nhdr header size when getting the build id data pointer and returns wrong build id data as result. This is problem only stable trees that merged c83a80d8b84f fix, the upstream build id code was refactored and returns proper build id. Fixes: c83a80d8b84f ("lib/buildid: harden build ID parsing logic") Signed-off-by: Jiri Olsa --- lib/buildid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/buildid.c b/lib/buildid.c index d3bc3d0528d5..9fc46366597e 100644 --- a/lib/buildid.c +++ b/lib/buildid.c @@ -40,7 +40,7 @@ static int parse_build_id_buf(unsigned char *build_id, name_sz == note_name_sz && memcmp(nhdr + 1, note_name, note_name_sz) == 0 && desc_sz > 0 && desc_sz <= BUILD_ID_SIZE_MAX) { - data = note_start + note_off + ALIGN(note_name_sz, 4); + data = note_start + note_off + sizeof(Elf32_Nhdr) + ALIGN(note_name_sz, 4); memcpy(build_id, data, desc_sz); memset(build_id + desc_sz, 0, BUILD_ID_SIZE_MAX - desc_sz); if (size) -- 2.47.0