User the proper helper for kernel or userspace addresses based on TASK_SIZE instead of the dangerous strncpy_from_unsafe function.
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -334,8 +334,11 @@ static void bpf_trace_copy_string(char *buf, void *unsafe_ptr, char fmt_ptype, · 333 unmodified lines | |||
| 334 | switch (fmt_ptype) { | 334 | switch (fmt_ptype) { |
| 335 | case 's': | 335 | case 's': |
| 336 | #ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE | 336 | #ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE |
| 337 | strncpy_from_unsafe(buf, unsafe_ptr, bufsz); | 337 | if ((unsigned long)unsafe_ptr < TASK_SIZE) { |
| 338 | break; | 338 | strncpy_from_user_nofault(buf, user_ptr, bufsz); |
| 339 | break; | ||
| 340 | } | ||
| 341 | fallthrough; | ||
| 339 | #endif | 342 | #endif |
| 340 | case 'k': | 343 | case 'k': |
| 341 | strncpy_from_kernel_nofault(buf, unsafe_ptr, bufsz); | 344 | strncpy_from_kernel_nofault(buf, unsafe_ptr, bufsz); |