mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
Merge branch 'Fix offset when fault occurs in strncpy_from_kernel_nofault()'
Alban Crequy says: ==================== Hi, This is v2 of the fix & selftest previously sent at: https://lore.kernel.org/linux-mm/20221108195211.214025-1-flaniel@linux.microsoft.com/ Changes v1 to v2: - add 'cc:stable', 'Fixes:' and review/ack tags - update commitmsg and fix my email - rebase on bpf tree and tag for bpf tree Thanks! ==================== Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
This commit is contained in:
commit
c20572600e
|
@ -97,7 +97,7 @@ long strncpy_from_kernel_nofault(char *dst, const void *unsafe_addr, long count)
|
|||
return src - unsafe_addr;
|
||||
Efault:
|
||||
pagefault_enable();
|
||||
dst[-1] = '\0';
|
||||
dst[0] = '\0';
|
||||
return -EFAULT;
|
||||
}
|
||||
|
||||
|
|
|
@ -63,6 +63,13 @@ void test_varlen(void)
|
|||
CHECK_VAL(data->total4, size1 + size2);
|
||||
CHECK(memcmp(data->payload4, exp_str, size1 + size2), "content_check",
|
||||
"doesn't match!\n");
|
||||
|
||||
CHECK_VAL(bss->ret_bad_read, -EFAULT);
|
||||
CHECK_VAL(data->payload_bad[0], 0x42);
|
||||
CHECK_VAL(data->payload_bad[1], 0x42);
|
||||
CHECK_VAL(data->payload_bad[2], 0);
|
||||
CHECK_VAL(data->payload_bad[3], 0x42);
|
||||
CHECK_VAL(data->payload_bad[4], 0x42);
|
||||
cleanup:
|
||||
test_varlen__destroy(skel);
|
||||
}
|
||||
|
|
|
@ -19,6 +19,7 @@ __u64 payload1_len1 = 0;
|
|||
__u64 payload1_len2 = 0;
|
||||
__u64 total1 = 0;
|
||||
char payload1[MAX_LEN + MAX_LEN] = {};
|
||||
__u64 ret_bad_read = 0;
|
||||
|
||||
/* .data */
|
||||
int payload2_len1 = -1;
|
||||
|
@ -36,6 +37,8 @@ int payload4_len2 = -1;
|
|||
int total4= -1;
|
||||
char payload4[MAX_LEN + MAX_LEN] = { 1 };
|
||||
|
||||
char payload_bad[5] = { 0x42, 0x42, 0x42, 0x42, 0x42 };
|
||||
|
||||
SEC("raw_tp/sys_enter")
|
||||
int handler64_unsigned(void *regs)
|
||||
{
|
||||
|
@ -61,6 +64,8 @@ int handler64_unsigned(void *regs)
|
|||
|
||||
total1 = payload - (void *)payload1;
|
||||
|
||||
ret_bad_read = bpf_probe_read_kernel_str(payload_bad + 2, 1, (void *) -1);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue