提交 2243c1ee 编写于 作者: A Andrii Nakryiko 提交者: Zheng Zengkai

selftests/bpf: Prevent out-of-bounds stack access in test_bpffs

mainline inclusion
from mainline-5.17-rc1
commit 57428298
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I5EUVD
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=57428298b5acf2ba2dd98359c532774f6eaeecb3

-------------------------------------------------

Buf can be not zero-terminated leading to strstr() to access data beyond
the intended buf[] array. Fix by forcing zero termination.
Signed-off-by: NAndrii Nakryiko <andrii@kernel.org>
Signed-off-by: NDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20211124002325.1737739-12-andrii@kernel.org
(cherry picked from commit 57428298)
Signed-off-by: NWang Yufen <wangyufen@huawei.com>
上级 b4a8fa25
...@@ -18,11 +18,13 @@ static int read_iter(char *file) ...@@ -18,11 +18,13 @@ static int read_iter(char *file)
fd = open(file, 0); fd = open(file, 0);
if (fd < 0) if (fd < 0)
return -1; return -1;
while ((len = read(fd, buf, sizeof(buf))) > 0) while ((len = read(fd, buf, sizeof(buf))) > 0) {
buf[sizeof(buf) - 1] = '\0';
if (strstr(buf, "iter")) { if (strstr(buf, "iter")) {
close(fd); close(fd);
return 0; return 0;
} }
}
close(fd); close(fd);
return -1; return -1;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册