Forwarded: [PATCH] bpf: reject VAR/DATASEC as a map's BTF value type

[syzbot <syzbot+37b56485bbbf90ad8489@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] bpf: reject VAR/DATASEC as a map's BTF value type
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


btf_type_id_size() resolves through BTF_KIND_VAR to the size of the
type it wraps, and BTF_KIND_DATASEC carries its own explicit size
field. This lets map_check_btf()'s size check pass for a
btf_value_type_id that points at a VAR or DATASEC, even though neither
describes the memory layout of a single map value - a VAR is a named
instance of a type (only meaningful inside a DATASEC), and a DATASEC
is a whole ELF section of such instances.

The unresolved VAR/DATASEC id is what gets stored as
map->btf_value_type_id and later handed to
htab_map_seq_show_elem() -> btf_type_seq_show_flags() ->
btf_type_show(), which calls btf_type_ops(t)->show() on it directly.
Reject both kinds explicitly in map_check_btf() instead, right after
the existing size check, so malformed BTF is rejected at
BPF_MAP_CREATE time with -EINVAL.

Reported-by: syzbot+37b56485bbbf90ad8489@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=37b56485bbbf90ad8489
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 kernel/bpf/syscall.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 6874ba1424af..15c4fba80cec 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1274,6 +1274,10 @@ static int map_check_btf(struct bpf_map *map, struct bpf_token *token,
 	if (!value_type || value_size != map->value_size)
 		return -EINVAL;
 
+	if (btf_type_is_var(value_type) ||
+            BTF_INFO_KIND(value_type->info) == BTF_KIND_DATASEC )
+		return -EINVAL;
+
 	map->record = btf_parse_fields(btf, value_type,
 				       BPF_SPIN_LOCK | BPF_RES_SPIN_LOCK | BPF_TIMER | BPF_KPTR | BPF_LIST_HEAD |
 				       BPF_RB_ROOT | BPF_REFCOUNT | BPF_WORKQUEUE | BPF_UPTR |
-- 
2.43.0