diff options
| author | Kumar Kartikeya Dwivedi <memxor@gmail.com> | 2022-06-15 07:21:51 +0300 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2022-06-15 20:32:12 +0300 |
| commit | d1a374a1aeb7e31191448e225ed2f9c5e894f280 (patch) | |
| tree | b585239a187d9415698d6841b05a1b8263a36153 /kernel/platform-feature.c | |
| parent | 3046a827316c0e55fc563b4fb78c93b9ca5c7c37 (diff) | |
| download | linux-d1a374a1aeb7e31191448e225ed2f9c5e894f280.tar.xz | |
bpf: Limit maximum modifier chain length in btf_check_type_tags
On processing a module BTF of module built for an older kernel, we might
sometimes find that some type points to itself forming a loop. If such a
type is a modifier, btf_check_type_tags's while loop following modifier
chain will be caught in an infinite loop.
Fix this by defining a maximum chain length and bailing out if we spin
any longer than that.
Fixes: eb596b090558 ("bpf: Ensure type tags precede modifiers in BTF")
Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20220615042151.2266537-1-memxor@gmail.com
Diffstat (limited to 'kernel/platform-feature.c')
0 files changed, 0 insertions, 0 deletions