Skip to content

Commit 6881af2

Browse files
tweejAlexei Starovoitov
authored andcommitted
selftests/bpf: Fix OOB read in dmabuf_collector
Dmabuf name allocations can be less than DMA_BUF_NAME_LEN characters, but bpf_probe_read_kernel always tries to read exactly that many bytes. If a name is less than DMA_BUF_NAME_LEN characters, bpf_probe_read_kernel will read past the end. bpf_probe_read_kernel_str stops at the first NUL terminator so use it instead, like iter_dmabuf_for_each already does. Fixes: ae5d2c5 ("selftests/bpf: Add test for dmabuf_iter") Reported-by: Jerome Lee <jaewookl@quicinc.com> Signed-off-by: T.J. Mercier <tjmercier@google.com> Link: https://lore.kernel.org/r/20260225003349.113746-1-tjmercier@google.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
1 parent 60e3cbe commit 6881af2

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

tools/testing/selftests/bpf/progs/dmabuf_iter.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ int dmabuf_collector(struct bpf_iter__dmabuf *ctx)
4848

4949
/* Buffers are not required to be named */
5050
if (pname) {
51-
if (bpf_probe_read_kernel(name, sizeof(name), pname))
51+
if (bpf_probe_read_kernel_str(name, sizeof(name), pname) < 0)
5252
return 1;
5353

5454
/* Name strings can be provided by userspace */

0 commit comments

Comments
 (0)