linux-kernel - [PATCH] libbpf: Fix NULL pointer dereference in find_extern_btf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 18 Mar 2024 11:16:25 +0800
From: zhangmingyi <zhangmingyi5@...wei.com>
To: <ast@...nel.org>, <daniel@...earbox.net>, <andrii@...nel.org>,
	<martin.lau@...ux.dev>, <song@...nel.org>, <yhs@...com>,
	<john.fastabend@...il.com>, <kpsingh@...nel.org>, <sdf@...gle.com>,
	<haoluo@...gle.com>, <jolsa@...nel.org>
CC: <bpf@...r.kernel.org>, <linux-kernel@...r.kernel.org>, <yanan@...wei.com>,
	<wuchangye@...wei.com>, <xiesongyang@...wei.com>, <kongweibin2@...wei.com>,
	<liuxin350@...wei.com>, Mingyi Zhang <zhangmingyi5@...wei.com>
Subject: [PATCH] libbpf: Fix NULL pointer dereference in find_extern_btf_id

From: Mingyi Zhang <zhangmingyi5@...wei.com>

During our fuzz testing, we encountered the following error:

Program received signal SIGSEGV, Segmentation fault.
0x00000000005915bb in __interceptor_strcmp.part.0 ()
(gdb) bt
    #0  0x00000000005915bb in __interceptor_strcmp.part.0 ()
    #1  0x000000000087dc65 in __wrap_strcmp ()
    #2  0x0000000000951ded in find_extern_btf_id () at libbpf.c:3508
    #3  0x000000000094d7a1 in bpf_object.collect_externs () at libbpf.c:3712
    #4  0x000000000092be3b in bpf_object_open () at libbpf.c:7433
    #5  0x000000000092c046 in bpf_object.open_mem () at libbpf.c:7497
    #6  0x0000000000924afa in LLVMFuzzerTestOneInput () at fuzz/bpf-object-fuzzer.c:16
    #7  0x000000000060be11 in testblitz_engine::fuzzer::Fuzzer::run_one ()
    #8  0x000000000087ad92 in tracing::span::Span::in_scope ()
    #9  0x00000000006078aa in testblitz_engine::fuzzer::util::walkdir ()
    #10 0x00000000005f3217 in testblitz_engine::entrypoint::main::{{closure}} ()
    #11 0x00000000005f2601 in main ()
(gdb)

tname = btf__name_by_offset(btf, t->name_off);
if (strcmp(tname, ext_name))
        continue;

tname is passed directly into strcmp without a null pointer check.
When t(btf_type)->name_off >= btf->hdr->str_len, tname is NULL. normally,
that's not likely to happen.
Considering that the bpf_object__open_mem interface is a direct API
provided to users, which reads directly from memory. There may be an
input similar to this fuzzing, leading to a Segmentation fault.

Signed-off-by: Mingyi Zhang <zhangmingyi5@...wei.com>
Signed-off-by: Xin Liu <liuxin350@...wei.com>
---
 tools/lib/bpf/libbpf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 604368cfbf02..c65d2f2abea4 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -3944,7 +3944,7 @@ static int find_extern_btf_id(const struct btf *btf, const char *ext_name)
 			continue;
 
 		tname = btf__name_by_offset(btf, t->name_off);
-		if (strcmp(tname, ext_name))
+		if (tname && strcmp(tname, ext_name))
 			continue;
 
 		if (btf_is_var(t) &&
-- 
2.33.0