]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
bpf: Fix bounds for bpf_prog_get_file_line linfo loop
authorKumar Kartikeya Dwivedi <memxor@gmail.com>
Sat, 5 Jul 2025 05:30:34 +0000 (22:30 -0700)
committerAlexei Starovoitov <ast@kernel.org>
Mon, 7 Jul 2025 15:30:15 +0000 (08:30 -0700)
commit116c8f474722bd06f314ca88fb1a01e5526e3366
tree5f79f43f07bb8fd19eae16b350a13530fde88d02
parent6e5cae9ddae7f14f5bffc34d12f45af756f86658
bpf: Fix bounds for bpf_prog_get_file_line linfo loop

We may overrun the bounds because linfo and jited_linfo are already
advanced to prog->aux->linfo_idx, hence we must only iterate the
remaining elements until we reach prog->aux->nr_linfo. Adjust the
nr_linfo calculation to fix this. Reported in [0].

  [0]: https://lore.kernel.org/bpf/f3527af3b0620ce36e299e97e7532d2555018de2.camel@gmail.com

Reported-by: Eduard Zingerman <eddyz87@gmail.com>
Fixes: 0e521efaf363 ("bpf: Add function to extract program source info")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20250705053035.3020320-2-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/core.c