diff options
| author | Kumar Kartikeya Dwivedi <memxor@gmail.com> | 2025-07-04 22:30:34 -0700 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2025-07-07 08:30:15 -0700 |
| commit | 116c8f474722bd06f314ca88fb1a01e5526e3366 (patch) | |
| tree | 5f79f43f07bb8fd19eae16b350a13530fde88d02 | |
| parent | 6e5cae9ddae7f14f5bffc34d12f45af756f86658 (diff) | |
bpf: Fix bounds for bpf_prog_get_file_line linfo loop
We may overrun the bounds because linfo and jited_linfo are already
advanced to prog->aux->linfo_idx, hence we must only iterate the
remaining elements until we reach prog->aux->nr_linfo. Adjust the
nr_linfo calculation to fix this. Reported in [0].
[0]: https://lore.kernel.org/bpf/f3527af3b0620ce36e299e97e7532d2555018de2.camel@gmail.com
Reported-by: Eduard Zingerman <eddyz87@gmail.com>
Fixes: 0e521efaf363 ("bpf: Add function to extract program source info")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20250705053035.3020320-2-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
| -rw-r--r-- | kernel/bpf/core.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index fe8a53f3c5bc..61613785bdd0 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -3244,6 +3244,7 @@ int bpf_prog_get_file_line(struct bpf_prog *prog, unsigned long ip, const char * struct bpf_line_info *linfo; void **jited_linfo; struct btf *btf; + int nr_linfo; btf = prog->aux->btf; linfo = prog->aux->linfo; @@ -3258,8 +3259,9 @@ int bpf_prog_get_file_line(struct bpf_prog *prog, unsigned long ip, const char * insn_start = linfo[0].insn_off; insn_end = insn_start + len; + nr_linfo = prog->aux->nr_linfo - prog->aux->linfo_idx; - for (int i = 0; i < prog->aux->nr_linfo && + for (int i = 0; i < nr_linfo && linfo[i].insn_off >= insn_start && linfo[i].insn_off < insn_end; i++) { if (jited_linfo[i] >= (void *)ip) break; |