The bpf_d_path() function may fail. If it does,
clear the user buf, like bpf_probe_read etc.

Signed-off-by: Tao Chen <[email protected]>
---
 kernel/trace/bpf_trace.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 0998cbbb963..bb1003cb271 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -916,11 +916,14 @@ BPF_CALL_3(bpf_d_path, struct path *, path, char *, buf, 
u32, sz)
         * potentially broken verifier.
         */
        len = copy_from_kernel_nofault(&copy, path, sizeof(*path));
-       if (len < 0)
+       if (len < 0) {
+               memset(buf, 0, sz);
                return len;
+       }
 
        p = d_path(&copy, buf, sz);
        if (IS_ERR(p)) {
+               memset(buf, 0, sz);
                len = PTR_ERR(p);
        } else {
                len = buf + sz - p;
-- 
2.48.1


Reply via email to