User the proper helper for kernel or userspace addresses based on TASK_SIZE instead of the dangerous strncpy_from_unsafe function.
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -334,8 +334,11 @@ static void bpf_trace_copy_string(char *buf, void *unsafe_ptr, char fmt_ptype, · 333 unmodified lines | ||
| 334 | 334 | switch (fmt_ptype) { |
| 335 | 335 | case 's': |
| 336 | 336 | #ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE |
| 337 | − strncpy_from_unsafe(buf, unsafe_ptr, bufsz); | |
| 338 | − break; | |
| 337 | + if ((unsigned long)unsafe_ptr < TASK_SIZE) { | |
| 338 | + strncpy_from_user_nofault(buf, user_ptr, bufsz); | |
| 339 | + break; | |
| 340 | + } | |
| 341 | + fallthrough; | |
| 339 | 342 | #endif |
| 340 | 343 | case 'k': |
| 341 | 344 | strncpy_from_kernel_nofault(buf, unsafe_ptr, bufsz); |