Merge branch 'Fix offset when fault occurs in strncpy_from_kernel_nofault()'
Alban Crequy says: ==================== Hi, This is v2 of the fix & selftest previously sent at: https://lore.kernel.org/linux-mm/20221108195211.214025-1-flaniel@linux.microsoft.com/ Changes v1 to v2: - add 'cc:stable', 'Fixes:' and review/ack tags - update commitmsg and fix my email - rebase on bpf tree and tag for bpf tree Thanks! ==================== Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
This commit is contained in:
commit
c20572600e
@ -97,7 +97,7 @@ long strncpy_from_kernel_nofault(char *dst, const void *unsafe_addr, long count)
|
|||||||
return src - unsafe_addr;
|
return src - unsafe_addr;
|
||||||
Efault:
|
Efault:
|
||||||
pagefault_enable();
|
pagefault_enable();
|
||||||
dst[-1] = '\0';
|
dst[0] = '\0';
|
||||||
return -EFAULT;
|
return -EFAULT;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -63,6 +63,13 @@ void test_varlen(void)
|
|||||||
CHECK_VAL(data->total4, size1 + size2);
|
CHECK_VAL(data->total4, size1 + size2);
|
||||||
CHECK(memcmp(data->payload4, exp_str, size1 + size2), "content_check",
|
CHECK(memcmp(data->payload4, exp_str, size1 + size2), "content_check",
|
||||||
"doesn't match!\n");
|
"doesn't match!\n");
|
||||||
|
|
||||||
|
CHECK_VAL(bss->ret_bad_read, -EFAULT);
|
||||||
|
CHECK_VAL(data->payload_bad[0], 0x42);
|
||||||
|
CHECK_VAL(data->payload_bad[1], 0x42);
|
||||||
|
CHECK_VAL(data->payload_bad[2], 0);
|
||||||
|
CHECK_VAL(data->payload_bad[3], 0x42);
|
||||||
|
CHECK_VAL(data->payload_bad[4], 0x42);
|
||||||
cleanup:
|
cleanup:
|
||||||
test_varlen__destroy(skel);
|
test_varlen__destroy(skel);
|
||||||
}
|
}
|
||||||
|
@ -19,6 +19,7 @@ __u64 payload1_len1 = 0;
|
|||||||
__u64 payload1_len2 = 0;
|
__u64 payload1_len2 = 0;
|
||||||
__u64 total1 = 0;
|
__u64 total1 = 0;
|
||||||
char payload1[MAX_LEN + MAX_LEN] = {};
|
char payload1[MAX_LEN + MAX_LEN] = {};
|
||||||
|
__u64 ret_bad_read = 0;
|
||||||
|
|
||||||
/* .data */
|
/* .data */
|
||||||
int payload2_len1 = -1;
|
int payload2_len1 = -1;
|
||||||
@ -36,6 +37,8 @@ int payload4_len2 = -1;
|
|||||||
int total4= -1;
|
int total4= -1;
|
||||||
char payload4[MAX_LEN + MAX_LEN] = { 1 };
|
char payload4[MAX_LEN + MAX_LEN] = { 1 };
|
||||||
|
|
||||||
|
char payload_bad[5] = { 0x42, 0x42, 0x42, 0x42, 0x42 };
|
||||||
|
|
||||||
SEC("raw_tp/sys_enter")
|
SEC("raw_tp/sys_enter")
|
||||||
int handler64_unsigned(void *regs)
|
int handler64_unsigned(void *regs)
|
||||||
{
|
{
|
||||||
@ -61,6 +64,8 @@ int handler64_unsigned(void *regs)
|
|||||||
|
|
||||||
total1 = payload - (void *)payload1;
|
total1 = payload - (void *)payload1;
|
||||||
|
|
||||||
|
ret_bad_read = bpf_probe_read_kernel_str(payload_bad + 2, 1, (void *) -1);
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
x
Reference in New Issue
Block a user