Hi.
First of all, I hope you are fine and the same for your relatives.
This contribution fixes a bug where the byte before the destination address can be reset when a page fault occurs in strncpy_from_kernel_nofault() while copying the first byte from the source address.
This bug leaded to kernel panic if a pointer containing the modified address is dereferenced as the pointer does not contain a correct addresss.
To fix this bug, we simply reset the current destination byte in a case of a page fault. The proposed fix was tested and validated inside a VM: root@vm-amd64:~# ./share/linux/tools/testing/selftests/bpf/test_progs --name varlen ... #222 varlen:OK Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED Without the patch, the test will fail: root@vm-amd64:~# ./share/linux/tools/testing/selftests/bpf/test_progs --name varlen ... #222 varlen:FAIL Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
If you see any way to improve this contribution, feel free to share.
Alban Crequy (2): maccess: fix writing offset in case of fault in strncpy_from_kernel_nofault() selftests: bpf: add a test when bpf_probe_read_kernel_str() returns EFAULT
mm/maccess.c | 2 +- tools/testing/selftests/bpf/prog_tests/varlen.c | 7 +++++++ tools/testing/selftests/bpf/progs/test_varlen.c | 5 +++++ 3 files changed, 13 insertions(+), 1 deletion(-)
Best regards and thank you in advance. -- 2.25.1