提交 31379397 编写于 作者: J Jiri Olsa 提交者: Daniel Borkmann

bpf: Forbid trampoline attach for functions with variable arguments

We can't currently allow to attach functions with variable arguments.
The problem is that we should save all the registers for arguments,
which is probably doable, but if caller uses more than 6 arguments,
we need stack data, which will be wrong, because of the extra stack
frame we do in bpf trampoline, so we could crash.

Also currently there's malformed trampoline code generated for such
functions at the moment as described in:

  https://lore.kernel.org/bpf/20210429212834.82621-1-jolsa@kernel.org/Signed-off-by: NJiri Olsa <jolsa@kernel.org>
Signed-off-by: NDaniel Borkmann <daniel@iogearbox.net>
Acked-by: NAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210505132529.401047-1-jolsa@kernel.org
上级 3b80d106
...@@ -5206,6 +5206,12 @@ int btf_distill_func_proto(struct bpf_verifier_log *log, ...@@ -5206,6 +5206,12 @@ int btf_distill_func_proto(struct bpf_verifier_log *log,
m->ret_size = ret; m->ret_size = ret;
for (i = 0; i < nargs; i++) { for (i = 0; i < nargs; i++) {
if (i == nargs - 1 && args[i].type == 0) {
bpf_log(log,
"The function %s with variable args is unsupported.\n",
tname);
return -EINVAL;
}
ret = __get_type_size(btf, args[i].type, &t); ret = __get_type_size(btf, args[i].type, &t);
if (ret < 0) { if (ret < 0) {
bpf_log(log, bpf_log(log,
...@@ -5213,6 +5219,12 @@ int btf_distill_func_proto(struct bpf_verifier_log *log, ...@@ -5213,6 +5219,12 @@ int btf_distill_func_proto(struct bpf_verifier_log *log,
tname, i, btf_kind_str[BTF_INFO_KIND(t->info)]); tname, i, btf_kind_str[BTF_INFO_KIND(t->info)]);
return -EINVAL; return -EINVAL;
} }
if (ret == 0) {
bpf_log(log,
"The function %s has malformed void argument.\n",
tname);
return -EINVAL;
}
m->arg_size[i] = ret; m->arg_size[i] = ret;
} }
m->nr_args = nargs; m->nr_args = nargs;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册