The bpf_d_path() function may fail. If it does, clear the user buf, like bpf_probe_read etc.
Signed-off-by: Tao Chen <[email protected]> --- kernel/trace/bpf_trace.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 0998cbbb963..bb1003cb271 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -916,11 +916,14 @@ BPF_CALL_3(bpf_d_path, struct path *, path, char *, buf, u32, sz) * potentially broken verifier. */ len = copy_from_kernel_nofault(©, path, sizeof(*path)); - if (len < 0) + if (len < 0) { + memset(buf, 0, sz); return len; + } p = d_path(©, buf, sz); if (IS_ERR(p)) { + memset(buf, 0, sz); len = PTR_ERR(p); } else { len = buf + sz - p; -- 2.48.1
