Commit 59383537 authored by Andrii Nakryiko's avatar Andrii Nakryiko Committed by Daniel Borkmann
Browse files

libbpf: Fix using invalidated memory in bpf_linker 



add_dst_sec() can invalidate bpf_linker's section index making
dst_symtab pointer pointing into unallocated memory. Reinitialize
dst_symtab pointer on each iteration to make sure it's always valid.

Fixes: faf6ed32 ("libbpf: Add BPF static linker APIs")
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20211124002325.1737739-7-andrii@kernel.org
parent 8cb12556

tools/lib/bpf/linker.c

+4 −1
Original line number Diff line number Diff line
@@ -2000,7 +2000,7 @@ static int linker_append_elf_sym(struct bpf_linker *linker, struct src_obj *obj, 
static int linker_append_elf_relos(struct bpf_linker *linker, struct src_obj *obj)

{

	struct src_sec *src_symtab = &obj->secs[obj->symtab_sec_idx];

	struct dst_sec *dst_symtab = &linker->secs[linker->symtab_sec_idx];

	struct dst_sec *dst_symtab;

	int i, err;



	for (i = 1; i < obj->sec_cnt; i++) {
@@ -2033,6 +2033,9 @@ static int linker_append_elf_relos(struct bpf_linker *linker, struct src_obj *ob 
			return -1;

		}



		/* add_dst_sec() above could have invalidated linker->secs */

		dst_symtab = &linker->secs[linker->symtab_sec_idx];



		/* shdr->sh_link points to SYMTAB */

		dst_sec->shdr->sh_link = linker->symtab_sec_idx;