diff options
| author | Alan Maguire <alan.maguire@oracle.com> | 2026-10-12 15:06:38 +0100 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-10-13 13:38:42 +0000 |
| commit | f6b6c87262da0ce58e9f24883cf6f7b2a3f2c338 (patch) | |
| tree | 01986ee95cbefa7bca2be3a43fa8d192bd936ae7 /kernel | |
| parent | 0d5e3fc78a6f2522e6339743b8e5ecc02351a9dd (diff) | |
btf: Fix size/vlen validation for BTF_KIND_LOC_PARAM
Validation logic allowed a BTF_KIND_LOC_PARAM with size <= 4
and vlen == 2, an inconsistent representation.
Fixes: a3df11403e8c8 ("bpf: Verify BTF_KIND_LOC_PARAM vlen, flags")
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261012140640.2932195-2-alan.maguire@oracle.com
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/btf.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index b09c04ccdc6d..64c78434fa05 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -4827,12 +4827,12 @@ static s32 btf_loc_param_check_meta(struct btf_verifier_env *env, case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_SIGNED: case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR: case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR | BTF_LOC_PARAM_SIGNED: - if (vlen > 2) + if (vlen < 1 || vlen > 2) goto invalid_vlen; - /* Ensure size/vlen are consistent */ - if (size > sizeof(__u32) && vlen != 2) + if (!size || size > sizeof(__u64)) goto invalid_vlen; - if (size > sizeof(__u64)) + /* Ensure size/vlen are consistent */ + if (vlen != (size > sizeof(__u32) ? 2 : 1)) goto invalid_vlen; break; case BTF_LOC_PARAM_REG: |