From: Khem Raj Date: Sat, 23 Aug 2025 20:04:04 +0000 (-0700) Subject: libseccomp: fix seccomp_export_bpf_mem out-of-bounds read X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4f26edb6fd7e3dc5f81c56faed3a0edd9264bf66;p=thirdparty%2Fopenembedded%2Fopenembedded-core-contrib.git libseccomp: fix seccomp_export_bpf_mem out-of-bounds read Fixes segfaults in ptests on musl Failed ptests: {'libseccomp': ['11-basic-basic_errors%%001-00001_11-basic-basic_errors_rc=139']} Signed-off-by: Khem Raj Signed-off-by: Mathieu Dubois-Briand --- diff --git a/meta/recipes-support/libseccomp/files/0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch b/meta/recipes-support/libseccomp/files/0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch new file mode 100644 index 00000000000..0d2910846c7 --- /dev/null +++ b/meta/recipes-support/libseccomp/files/0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch @@ -0,0 +1,37 @@ +From 83a56d74482ef6b6cc9311b14bf9ea23573f5d4e Mon Sep 17 00:00:00 2001 +From: Alyssa Ross +Date: Thu, 13 Feb 2025 12:05:17 +0100 +Subject: [PATCH] api: fix seccomp_export_bpf_mem out-of-bounds read + +*len is the length of the destination buffer, but program->blks is +probably not anywhere near that long. It's already been checked above +that BPF_PGM_SIZE(program) is less than or equal to *len, so that's +the correct value to use here to avoid either reading or writing too +much. + +I noticed this because tests/11-basic-basic_errors started failing on +musl after e797591 ("all: add seccomp_precompute() functionality"). + +Upstream-Status: Backport [https://github.com/seccomp/libseccomp/commit/dd759e8c4f5685b526638fba9ec4fc24c37c9aec] +Signed-off-by: Alyssa Ross +Acked-by: Tom Hromatka +Signed-off-by: Paul Moore +(imported from commit e8dbc6b555fb936bdfb8ab86f9a45fda96a8b7a2) +Signed-off-by: Khem Raj +--- + src/api.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/api.c b/src/api.c +index adccef3..65a277a 100644 +--- a/src/api.c ++++ b/src/api.c +@@ -786,7 +786,7 @@ API int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf, + if (BPF_PGM_SIZE(program) > *len) + rc = _rc_filter(-ERANGE); + else +- memcpy(buf, program->blks, *len); ++ memcpy(buf, program->blks, BPF_PGM_SIZE(program)); + } + *len = BPF_PGM_SIZE(program); + diff --git a/meta/recipes-support/libseccomp/libseccomp_2.6.0.bb b/meta/recipes-support/libseccomp/libseccomp_2.6.0.bb index 97988afa27b..998f1b5548d 100644 --- a/meta/recipes-support/libseccomp/libseccomp_2.6.0.bb +++ b/meta/recipes-support/libseccomp/libseccomp_2.6.0.bb @@ -10,6 +10,7 @@ DEPENDS += "gperf-native" SRCREV = "c7c0caed1d04292500ed4b9bb386566053eb9775" SRC_URI = "git://github.com/seccomp/libseccomp.git;branch=release-2.6;protocol=https \ + file://0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch \ file://run-ptest \ "