diff options
| author | T.J. Mercier <tjmercier@google.com> | 2026-02-24 16:33:48 -0800 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-02-26 11:28:04 -0800 |
| commit | 6881af27f9ea0f5ca8f606f573ef5cc25ca31fe4 (patch) | |
| tree | 7d7575423bdfde6af6d85b653ebccd87787cebc3 /kernel/bpf/arraymap.c | |
| parent | 60e3cbef3500ad6101bc91946e645f69b1bb9556 (diff) | |
selftests/bpf: Fix OOB read in dmabuf_collector
Dmabuf name allocations can be less than DMA_BUF_NAME_LEN characters,
but bpf_probe_read_kernel always tries to read exactly that many bytes.
If a name is less than DMA_BUF_NAME_LEN characters,
bpf_probe_read_kernel will read past the end. bpf_probe_read_kernel_str
stops at the first NUL terminator so use it instead, like
iter_dmabuf_for_each already does.
Fixes: ae5d2c59ecd7 ("selftests/bpf: Add test for dmabuf_iter")
Reported-by: Jerome Lee <jaewookl@quicinc.com>
Signed-off-by: T.J. Mercier <tjmercier@google.com>
Link: https://lore.kernel.org/r/20260225003349.113746-1-tjmercier@google.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'kernel/bpf/arraymap.c')
0 files changed, 0 insertions, 0 deletions
