Star0
9
代码
代码
Issues5
Pull Requests13
项目讨论
Wiki
分析
Star0
9
已开启
[sync] PR-182: backport patches form upstream #194
AtomGit-Bot创建于 2025年8月14日
[sync] PR-182: backport patches form upstream #194
已开启
AtomGit-Bot创建于 2025年8月14日
从sync-pr182-master-to-openEuler-25.09合入到openEuler-25.09
共 4 个文件变更+165-1
Abackport-libbpf-Fix-hypothetical-STT_SECTION-extern-NULL-deref-case.patch+34-0
@@ -0,0 +1,34 @@
1+From f51de57e54d9a28a065c301ec0536ad377a134cc Mon Sep 17 00:00:00 2001
2+From: Andrii Nakryiko <andrii@kernel.org>
3+Date: Wed, 19 Feb 2025 16:28:21 -0800
4+Subject: [PATCH] libbpf: Fix hypothetical STT_SECTION extern NULL deref case
5+ 
6+Fix theoretical NULL dereference in linker when resolving *extern*
7+STT_SECTION symbol against not-yet-existing ELF section. Not sure if
8+it's possible in practice for valid ELF object files (this would require
9+embedded assembly manipulations, at which point BTF will be missing),
10+but fix the s/dst_sym/dst_sec/ typo guarding this condition anyways.
11+ 
12+Fixes: faf6ed321cf6 ("libbpf: Add BPF static linker APIs")
13+Fixes: a46349227cd8 ("libbpf: Add linker extern resolution support for functions and global variables")
14+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
15+Link: https://lore.kernel.org/r/20250220002821.834400-1-andrii@kernel.org
16+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
17+Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
18+---
19+ src/linker.c | 2 +-
20+ 1 file changed, 1 insertion(+), 1 deletion(-)
21+ 
22+diff --git a/src/linker.c b/src/linker.c
23+index b52f71c59..800e0ef09 100644
24+--- a/src/linker.c
25++++ b/src/linker.c
26+@@ -2163,7 +2163,7 @@ static int linker_append_elf_sym(struct bpf_linker *linker, struct src_obj *obj,
27+
28+ obj->sym_map[src_sym_idx] = dst_sym_idx;
29+
30+- if (sym_type == STT_SECTION && dst_sym) {
31++ if (sym_type == STT_SECTION && dst_sec) {
32+ dst_sec->sec_sym_idx = dst_sym_idx;
33+ dst_sym->st_value = 0;
34+ }
Abackport-libbpf-Fix-out-of-bound-read.patch+36-0
@@ -0,0 +1,36 @@
1+From d4d238b1314a9ecd027f2ffefe63f96547640b62 Mon Sep 17 00:00:00 2001
2+From: Nandakumar Edamana <nandakumar@nandakumar.co.in>
3+Date: Sat, 22 Feb 2025 02:31:11 +0530
4+Subject: [PATCH] libbpf: Fix out-of-bound read
5+ 
6+In `set_kcfg_value_str`, an untrusted string is accessed with the assumption
7+that it will be at least two characters long due to the presence of checks for
8+opening and closing quotes. But the check for the closing quote
9+(value[len - 1] != '"') misses the fact that it could be checking the opening
10+quote itself in case of an invalid input that consists of just the opening
11+quote.
12+ 
13+This commit adds an explicit check to make sure the string is at least two
14+characters long.
15+ 
16+Signed-off-by: Nandakumar Edamana <nandakumar@nandakumar.co.in>
17+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
18+Link: https://lore.kernel.org/bpf/20250221210110.3182084-1-nandakumar@nandakumar.co.in
19+Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
20+---
21+ src/libbpf.c | 2 +-
22+ 1 file changed, 1 insertion(+), 1 deletion(-)
23+ 
24+diff --git a/src/libbpf.c b/src/libbpf.c
25+index 6df258912..899e98225 100644
26+--- a/src/libbpf.c
27++++ b/src/libbpf.c
28+@@ -2106,7 +2106,7 @@ static int set_kcfg_value_str(struct extern_desc *ext, char *ext_val,
29+ }
30+
31+ len = strlen(value);
32+- if (value[len - 1] != '"') {
33++ if (len < 2 || value[len - 1] != '"') {
34+ pr_warn("extern (kcfg) '%s': invalid string config '%s'\n",
35+ ext->name, value);
36+ return -EINVAL;
Abackport-libbpf-fix-LDX_STX_ST-CO-RE-relocation-size-adjustment-logic.patch+85-0
@@ -0,0 +1,85 @@
1+From 330a7f3e82e2154fa2da1af79d0525043d08d08a Mon Sep 17 00:00:00 2001
2+From: Andrii Nakryiko <andrii@kernel.org>
3+Date: Thu, 6 Feb 2025 17:48:08 -0800
4+Subject: [PATCH] libbpf: fix LDX/STX/ST CO-RE relocation size adjustment logic
5+ 
6+Libbpf has a somewhat obscure feature of automatically adjusting the
7+"size" of LDX/STX/ST instruction (memory store and load instructions),
8+based on originally recorded access size (u8, u16, u32, or u64) and the
9+actual size of the field on target kernel. This is meant to facilitate
10+using BPF CO-RE on 32-bit architectures (pointers are always 64-bit in
11+BPF, but host kernel's BTF will have it as 32-bit type), as well as
12+generally supporting safe type changes (unsigned integer type changes
13+can be transparently "relocated").
14+ 
15+One issue that surfaced only now, 5 years after this logic was
16+implemented, is how this all works when dealing with fields that are
17+arrays. This isn't all that easy and straightforward to hit (see
18+selftests that reproduce this condition), but one of sched_ext BPF
19+programs did hit it with innocent looking loop.
20+ 
21+Long story short, libbpf used to calculate entire array size, instead of
22+making sure to only calculate array's element size. But it's the element
23+that is loaded by LDX/STX/ST instructions (1, 2, 4, or 8 bytes), so
24+that's what libbpf should check. This patch adjusts the logic for
25+arrays and fixed the issue.
26+ 
27+Reported-by: Emil Tsalapatis <emil@etsalapatis.com>
28+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
29+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
30+Link: https://lore.kernel.org/r/20250207014809.1573841-1-andrii@kernel.org
31+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
32+Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
33+---
34+ src/relo_core.c | 24 ++++++++++++++++++++----
35+ 1 file changed, 20 insertions(+), 4 deletions(-)
36+ 
37+diff --git a/src/relo_core.c b/src/relo_core.c
38+index 7632e9d41..2b83c98a1 100644
39+--- a/src/relo_core.c
40++++ b/src/relo_core.c
41+@@ -683,7 +683,7 @@ static int bpf_core_calc_field_relo(const char *prog_name,
42+ {
43+ const struct bpf_core_accessor *acc;
44+ const struct btf_type *t;
45+- __u32 byte_off, byte_sz, bit_off, bit_sz, field_type_id;
46++ __u32 byte_off, byte_sz, bit_off, bit_sz, field_type_id, elem_id;
47+ const struct btf_member *m;
48+ const struct btf_type *mt;
49+ bool bitfield;
50+@@ -706,8 +706,14 @@ static int bpf_core_calc_field_relo(const char *prog_name,
51+ if (!acc->name) {
52+ if (relo->kind == BPF_CORE_FIELD_BYTE_OFFSET) {
53+ *val = spec->bit_offset / 8;
54+- /* remember field size for load/store mem size */
55+- sz = btf__resolve_size(spec->btf, acc->type_id);
56++ /* remember field size for load/store mem size;
57++ * note, for arrays we care about individual element
58++ * sizes, not the overall array size
59++ */
60++ t = skip_mods_and_typedefs(spec->btf, acc->type_id, &elem_id);
61++ while (btf_is_array(t))
62++ t = skip_mods_and_typedefs(spec->btf, btf_array(t)->type, &elem_id);
63++ sz = btf__resolve_size(spec->btf, elem_id);
64+ if (sz < 0)
65+ return -EINVAL;
66+ *field_sz = sz;
67+@@ -767,7 +773,17 @@ static int bpf_core_calc_field_relo(const char *prog_name,
68+ case BPF_CORE_FIELD_BYTE_OFFSET:
69+ *val = byte_off;
70+ if (!bitfield) {
71+- *field_sz = byte_sz;
72++ /* remember field size for load/store mem size;
73++ * note, for arrays we care about individual element
74++ * sizes, not the overall array size
75++ */
76++ t = skip_mods_and_typedefs(spec->btf, field_type_id, &elem_id);
77++ while (btf_is_array(t))
78++ t = skip_mods_and_typedefs(spec->btf, btf_array(t)->type, &elem_id);
79++ sz = btf__resolve_size(spec->btf, elem_id);
80++ if (sz < 0)
81++ return -EINVAL;
82++ *field_sz = sz;
83+ *type_id = field_type_id;
84+ }
85+ break;
Mlibbpf.spec+10-1
@@ -4,7 +4,7 @@
4 4 
5Name: %{githubname}5Name: %{githubname}
6Version: %{githubver}6Version: %{githubver}
7-Release: 97+Release: 10
8Summary: Libbpf library8Summary: Libbpf library
9 9 
10License: LGPLv2 or BSD10License: LGPLv2 or BSD
@@ -30,6 +30,9 @@ Patch0013: backport-libbpf-Fixed-getting-wrong-return-address-on-arm64-a.pa
30Patch0014: backport-libbpf-fix-sym_is_subprog-logic-for-weak-global-subp.patch30Patch0014: backport-libbpf-fix-sym_is_subprog-logic-for-weak-global-subp.patch
31Patch0015: backport-libbpf-move-global-data-mmap-ing-into-bpf_object__lo.patch31Patch0015: backport-libbpf-move-global-data-mmap-ing-into-bpf_object__lo.patch
32Patch0016: backport-libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch32Patch0016: backport-libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
33+Patch0017: backport-libbpf-Fix-out-of-bound-read.patch
34+Patch0018: backport-libbpf-fix-LDX_STX_ST-CO-RE-relocation-size-adjustment-logic.patch
35+Patch0019: backport-libbpf-Fix-hypothetical-STT_SECTION-extern-NULL-deref-case.patch
33 36 
34# This package supersedes libbpf from kernel-tools,37# This package supersedes libbpf from kernel-tools,
35# which has default Epoch: 0. By having Epoch: 138# which has default Epoch: 0. By having Epoch: 1
@@ -82,6 +85,12 @@ developing applications that use %{name}
82%{_libdir}/libbpf.a85%{_libdir}/libbpf.a
83 86 
84%changelog87%changelog
88+* Mon Jul 14 2025 andy <liuyang01@kylinos.cn> 2:1.2.2-10
89+- backport patch from upstream:
90+ backport-libbpf-Fix-out-of-bound-read.patch
91+ backport-libbpf-fix-LDX_STX_ST-CO-RE-relocation-size-adjustment-logic.patch
92+ backport-libbpf-Fix-hypothetical-STT_SECTION-extern-NULL-deref-case.patch
93+ 
85* Fri Mar 14 2025 zhangmingyi <zhangmingyi5@huawei.com> 2:1.2.2-994* Fri Mar 14 2025 zhangmingyi <zhangmingyi5@huawei.com> 2:1.2.2-9
86- backport patch from upstream:95- backport patch from upstream:
87 backport-libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch96 backport-libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch