已开启
libbpf: validate ELF symbol table entry size (backport 6c8e5e7) #241
Lei-Chen创建于 3 天前
libbpf: validate ELF symbol table entry size (backport 6c8e5e7) #241
已开启
共 2 个文件变更+43-1
| @@ -0,0 +1,38 @@ | |||
| 1 | +From 6c8e5e7d981b45619eccd22d895cec3c6afe3418 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Luis Vieira <luisflavieira@gmail.com> | ||
| 3 | +Date: Wed, 16 Sep 2026 18:23:35 -0300 | ||
| 4 | +Subject: [PATCH] libbpf: Validate ELF symbol table entry size | ||
| 5 | + | ||
| 6 | +elf_sym_iter_new() calculates the number of symbols by dividing the | ||
| 7 | +symbol table data size by sh_entsize. A malformed ELF file with a zero | ||
| 8 | +sh_entsize causes a division by zero. | ||
| 9 | + | ||
| 10 | +Reject symbol table sections with a zero entry size before calculating | ||
| 11 | +the number of symbols. | ||
| 12 | + | ||
| 13 | +(backported from commit 6c8e5e7d981b45619eccd22d895cec3c6afe3418) | ||
| 14 | + | ||
| 15 | +Conflict: v1.2.2 performs the same division inline in | ||
| 16 | +elf_find_func_offset(); add the equivalent check there. | ||
| 17 | + | ||
| 18 | +Reference: https://github.com/libbpf/libbpf/commit/6c8e5e7d981b45619eccd22d895cec3c6afe3418 | ||
| 19 | + | ||
| 20 | +diff --git a/src/libbpf.c b/src/libbpf.c | ||
| 21 | +index 6df54e4e42c3..7f1e1a2fb213 100644 | ||
| 22 | +--- a/src/libbpf.c | ||
| 23 | ++++ b/src/libbpf.c | ||
| 24 | +@@ -10819,6 +10819,12 @@ | ||
| 25 | + } | ||
| 26 | + if (!gelf_getshdr(scn, &sh)) | ||
| 27 | + continue; | ||
| 28 | ++ if (!sh.sh_entsize) { | ||
| 29 | ++ pr_warn("elf: invalid symbol table entry size in '%s'\n", | ||
| 30 | ++ binary_path); | ||
| 31 | ++ ret = -LIBBPF_ERRNO__FORMAT; | ||
| 32 | ++ goto out; | ||
| 33 | ++ } | ||
| 34 | + strtabidx = sh.sh_link; | ||
| 35 | + symbols = elf_getdata(scn, 0); | ||
| 36 | + if (!symbols) { | ||
| 37 | +-- | ||
| 38 | +2.20.1 | ||
| @@ -4,7 +4,7 @@ | |||
| 4 | 4 | ||
| 5 | Name: %{githubname} | 5 | Name: %{githubname} |
| 6 | Version: %{githubver} | 6 | Version: %{githubver} |
| 7 | -Release: 17 | 7 | +Release: 18 |
| 8 | Summary: Libbpf library | 8 | Summary: Libbpf library |
| 9 | 9 | ||
| 10 | License: LGPLv2 or BSD | 10 | License: LGPLv2 or BSD |
| @@ -38,6 +38,7 @@ Patch0021: backport-libbpf-Fix-buffer-overflow-in-bpf_object__init_prog.pat | |||
| 38 | Patch0022: backport-libbpf-Fix-comment-about-arc-and-riscv-arch-in-bpf_tracing.h.patch | 38 | Patch0022: backport-libbpf-Fix-comment-about-arc-and-riscv-arch-in-bpf_tracing.h.patch |
| 39 | Patch0023: backport-libbpf-Store-zero-fd-to-fd_array-for-loader-kfunc-relocation.patch | 39 | Patch0023: backport-libbpf-Store-zero-fd-to-fd_array-for-loader-kfunc-relocation.patch |
| 40 | Patch0024: backport-ELF-fix-all-Elf-typos.patch | 40 | Patch0024: backport-ELF-fix-all-Elf-typos.patch |
| 41 | +Patch0025: backport-libbpf-Validate-ELF-symbol-table-entry-size.patch | ||
| 41 | 42 | ||
| 42 | # This package supersedes libbpf from kernel-tools, | 43 | # This package supersedes libbpf from kernel-tools, |
| 43 | # which has default Epoch: 0. By having Epoch: 1 | 44 | # which has default Epoch: 0. By having Epoch: 1 |
| @@ -90,6 +91,9 @@ developing applications that use %{name} | |||
| 90 | %{_libdir}/libbpf.a | 91 | %{_libdir}/libbpf.a |
| 91 | 92 | ||
| 92 | %changelog | 93 | %changelog |
| 94 | +* Mon Nov 02 2026 Lei-Chen <dev03108@linx-info.com> - 2:1.2.2-18 | ||
| 95 | +- Fix division by zero when parsing a malformed ELF symbol table | ||
| 96 | + | ||
| 93 | * Sat Oct 10 2026 xuhou <houxu5@h-partners.com> 2:1.2.2-17 | 97 | * Sat Oct 10 2026 xuhou <houxu5@h-partners.com> 2:1.2.2-17 |
| 94 | - revert backport-libbpf-Fix-BPF_SCHED-enum-value-mismatch-with-kernel.patch | 98 | - revert backport-libbpf-Fix-BPF_SCHED-enum-value-mismatch-with-kernel.patch |
| 95 | 99 | ||