[PATCH bpf-next] bpf: Fix out-of-bounds btf->types write for split BTF

[Feng Yang]

From: Feng Yang <yangfeng@xxxxxxxxxx>

btf_add_type() bounds the btf->types array by BTF_MAX_TYPE, but for a
split BTF the type ids it registers are start_id .. start_id +
nr_types - 1, so what is actually left of the id space is
BTF_MAX_TYPE - start_id.  Two things follow from that:

 - the limit check is an equality test,
   'start_id + btf->types_size == BTF_MAX_TYPE'.  It is evaluated only
   when the array has to grow, with btf->types_size == btf->nr_types,
   and the growth (T' = min(BTF_MAX_TYPE, T + max(T / 4, 16)), starting
   from 0) is clamped to BTF_MAX_TYPE, which it lands on exactly (...,
   928143, then min(BTF_MAX_TYPE, 1160178)).  So unless
   BTF_MAX_TYPE - start_id is one of the 48 sizes that sequence hits,
   the check does not fire for a split BTF at all;

 - new_size is clamped to BTF_MAX_TYPE instead of
   BTF_MAX_TYPE - start_id, so the array can still grow to
   BTF_MAX_TYPE entries even though only BTF_MAX_TYPE - start_id type
   ids exist.

As a result nr_types can reach BTF_MAX_TYPE for a split BTF while its
type ids have already gone past BTF_MAX_TYPE; a type never validates its
own id, only the ids it references (btf_ref_type_check_meta()).  At that
point btf->types_size == btf->nr_types == BTF_MAX_TYPE and the growth
branch computes the same size again: it allocates a fresh BTF_MAX_TYPE
entry array, copies the entries, and the loop is left with
btf->types_size != btf->nr_types, so that branch is not taken anymore.
Every type after this writes btf->types[btf->nr_types++] past the end of
the array: BTF_MAX_TYPE * 8 == 8388600 bytes are requested, so the first
such write lands in the 8 byte rounding slack of the 8MB allocation, and
each further type writes another 8 bytes beyond it.

Fix both by bounding the array with BTF_MAX_TYPE - start_id and by
turning the equality check into a '>=' one, so that the array stops
exactly where the id space ends. Base BTF behavior (start_id ==
0) is unchanged.

Fixes: 951bb64621b8 ("bpf: Add in-kernel split BTF support")
Signed-off-by: Feng Yang <yangfeng@xxxxxxxxxx>
---
 kernel/bpf/btf.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 80b6f96263f1..6e54cd6c2eb5 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -1724,15 +1724,17 @@ static int btf_add_type(struct btf_verifier_env *env, struct btf_type *t)
 		/* Expand 'types' array */
 
 		struct btf_type **new_types;
-		u32 expand_by, new_size;
+		u32 expand_by, new_size, max_size;
 
-		if (btf->start_id + btf->types_size == BTF_MAX_TYPE) {
+		if (btf->start_id >= BTF_MAX_TYPE ||
+		    btf->start_id + btf->types_size >= BTF_MAX_TYPE) {
 			btf_verifier_log(env, "Exceeded max num of types");
 			return -E2BIG;
 		}
 
+		max_size = BTF_MAX_TYPE - btf->start_id;
 		expand_by = max_t(u32, btf->types_size >> 2, 16);
-		new_size = min_t(u32, BTF_MAX_TYPE,
+		new_size = min_t(u32, max_size,
 				 btf->types_size + expand_by);
 
 		new_types = kvzalloc_objs(*new_types, new_size,
-- 
2.25.1