Re: [PATCH bpf] bpf: fix a buffer out-of-bound access when filling raw_tp link_info

On Fri, Aug 21, 2020 at 1:09 PM Andrii Nakryiko wrote: > > On Fri, Aug 21, 2020 at 12:11 PM Yonghong Song wrote: > > > > Commit f2e10bff16a0 ("bpf: Add support for BPF_OBJ_GET_INFO_BY_FD for > > bpf_link") > > added link query for raw_tp. One of fields in link_info is to > > fill a user buffer w

Re: [PATCH bpf] bpf: fix a buffer out-of-bound access when filling raw_tp link_info

On Fri, Aug 21, 2020 at 12:11 PM Yonghong Song wrote: > > Commit f2e10bff16a0 ("bpf: Add support for BPF_OBJ_GET_INFO_BY_FD for > bpf_link") > added link query for raw_tp. One of fields in link_info is to > fill a user buffer with tp_name. The Scurrent checking only > declares "ulen && !ubuf" as

[PATCH bpf] bpf: fix a buffer out-of-bound access when filling raw_tp link_info

Commit f2e10bff16a0 ("bpf: Add support for BPF_OBJ_GET_INFO_BY_FD for bpf_link") added link query for raw_tp. One of fields in link_info is to fill a user buffer with tp_name. The Scurrent checking only declares "ulen && !ubuf" as invalid. So "!ulen && ubuf" will be valid. Later on, we do "copy_to_