bpf: btf: Ensure the member->offset is in the right order

This patch ensures the member->offset of a struct
is in the correct order (i.e the later member's offset cannot
go backward).

The current "pahole -J" BTF encoder does not generate something
like this.  However, checking this can ensure future encoder
will not violate this.

Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

1 files changed, 13 insertions, 1 deletions

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 9704934252b3..2590700237c1 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -1519,9 +1519,9 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
 {
         bool is_union = BTF_INFO_KIND(t->info) == BTF_KIND_UNION;
         const struct btf_member *member;
+        u32 meta_needed, last_offset;
         struct btf *btf = env->btf;
         u32 struct_size = t->size;
-        u32 meta_needed;
         u16 i;
 
         meta_needed = btf_type_vlen(t) * sizeof(*member);
@@ -1534,6 +1534,7 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
 
         btf_verifier_log_type(env, t, NULL);
 
+        last_offset = 0;
         for_each_member(i, t, member) {
                 if (!btf_name_offset_valid(btf, member->name_off)) {
                         btf_verifier_log_member(env, t, member,
@@ -1555,6 +1556,16 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
                         return -EINVAL;
                 }
 
+                /*
+                 * ">" instead of ">=" because the last member could be
+                 * "char a[0];"
+                 */
+                if (last_offset > member->offset) {
+                        btf_verifier_log_member(env, t, member,
+                                                "Invalid member bits_offset");
+                        return -EINVAL;
+                }
+
                 if (BITS_ROUNDUP_BYTES(member->offset) > struct_size) {
                         btf_verifier_log_member(env, t, member,
                                                 "Memmber bits_offset exceeds its struct size");
@@ -1562,6 +1573,7 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
                 }
 
                 btf_verifier_log_member(env, t, member, NULL);
+                last_offset = member->offset;
         }
 
         return meta_needed;