summaryrefslogtreecommitdiff
path: root/scripts/patch-kernel
diff options
context:
space:
mode:
authorArnaldo Carvalho de Melo <acme@redhat.com>2026-08-02 11:27:11 -0300
committerNamhyung Kim <namhyung@kernel.org>2026-08-05 11:20:02 -0700
commit38ba525335c4399b15c9be0f81de304e94ccb462 (patch)
tree8acfad1110dfb65906f0d528612c64ea8e7de2d0 /scripts/patch-kernel
parent60f2f5b7650bb8779af3087ef429fad4ed74a5c8 (diff)
downloadlinux-38ba525335c4399b15c9be0f81de304e94ccb462.tar.gz
linux-38ba525335c4399b15c9be0f81de304e94ccb462.zip
perf bpf: Add PROG_TAGS to required arrays in __bpf_event__print_bpf_prog_info()
synthesize_bpf_prog_name() unconditionally dereferences prog_tags[sub_id] (line: u8 (*prog_tags)[BPF_TAG_SIZE] = (void *)(uintptr_t)(info->prog_tags)) but __bpf_event__print_bpf_prog_info() only requires JITED_KSYMS and JITED_FUNC_LENS in its required_arrays bitmask. If a crafted perf.data has the PROG_TAGS bit cleared (or the array was invalidated by bpil_offs_to_addr() bounds checking), info->prog_tags contains either zero or a raw file offset. Dereferencing it causes a NULL pointer dereference or an arbitrary memory read. Add PERF_BPIL_PROG_TAGS to required_arrays so the function returns early when prog_tags was not present or failed validation. Fixes: f8dfeae009effc0b ("perf bpf: Show more BPF program info in print_bpf_prog_info()") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Song Liu <songliubraving@fb.com> Reviewed-by: Ian Rogers <irogers@google.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Diffstat (limited to 'scripts/patch-kernel')
0 files changed, 0 insertions, 0 deletions