diff options
| author | Arnaldo Carvalho de Melo <acme@redhat.com> | 2026-08-02 11:27:11 -0300 |
|---|---|---|
| committer | Namhyung Kim <namhyung@kernel.org> | 2026-08-05 11:20:02 -0700 |
| commit | 38ba525335c4399b15c9be0f81de304e94ccb462 (patch) | |
| tree | 8acfad1110dfb65906f0d528612c64ea8e7de2d0 /scripts/objdiff | |
| parent | 60f2f5b7650bb8779af3087ef429fad4ed74a5c8 (diff) | |
| download | linux-38ba525335c4399b15c9be0f81de304e94ccb462.tar.gz linux-38ba525335c4399b15c9be0f81de304e94ccb462.zip | |
perf bpf: Add PROG_TAGS to required arrays in __bpf_event__print_bpf_prog_info()
synthesize_bpf_prog_name() unconditionally dereferences prog_tags[sub_id]
(line: u8 (*prog_tags)[BPF_TAG_SIZE] = (void *)(uintptr_t)(info->prog_tags))
but __bpf_event__print_bpf_prog_info() only requires JITED_KSYMS and
JITED_FUNC_LENS in its required_arrays bitmask.
If a crafted perf.data has the PROG_TAGS bit cleared (or the array was
invalidated by bpil_offs_to_addr() bounds checking), info->prog_tags
contains either zero or a raw file offset. Dereferencing it causes a
NULL pointer dereference or an arbitrary memory read.
Add PERF_BPIL_PROG_TAGS to required_arrays so the function returns early
when prog_tags was not present or failed validation.
Fixes: f8dfeae009effc0b ("perf bpf: Show more BPF program info in print_bpf_prog_info()")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Song Liu <songliubraving@fb.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Diffstat (limited to 'scripts/objdiff')
0 files changed, 0 insertions, 0 deletions
