diff options
| author | Kumar Kartikeya Dwivedi <memxor@gmail.com> | 2026-08-23 21:32:00 +0200 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2026-08-25 17:00:05 +0200 |
| commit | ea0b60fae724aa1147d4a07eda5131d3a9a9977e (patch) | |
| tree | 60aff849e1f145ade14448769207e71c1a56a6a3 /include/linux | |
| parent | ce36e38beb6863664994f5676122359c8d323203 (diff) | |
| download | linux-next-ea0b60fae724aa1147d4a07eda5131d3a9a9977e.tar.gz linux-next-ea0b60fae724aa1147d4a07eda5131d3a9a9977e.zip | |
bpf: Reject oversized stream read buffers
BPF_PROG_STREAM_READ_BY_FD exposes stream_buf_len as a u32, but the
internal stream reader accepts an int. Values above INT_MAX therefore
become negative before bpf_stream_read(), producing negative consumption
lengths. The generic usercopy size check prevents the oversized copy, but
emits a warning and reports EFAULT for an unchecked argument.
Change bpf_prog_stream_read() to accept u32 and reject values that the
signed reader cannot represent.
Fixes: 5ab154f1463a ("bpf: Introduce BPF standard streams")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260823193202.2389715-2-memxor@gmail.com
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/bpf.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/linux/bpf.h b/include/linux/bpf.h index b3cd28d9e3b5..c2027688be3e 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -4101,7 +4101,7 @@ void bpf_put_buffers(void); void bpf_prog_stream_init(struct bpf_prog *prog); void bpf_prog_stream_free(struct bpf_prog *prog); -int bpf_prog_stream_read(struct bpf_prog *prog, enum bpf_stream_id stream_id, void __user *buf, int len); +int bpf_prog_stream_read(struct bpf_prog *prog, enum bpf_stream_id stream_id, void __user *buf, u32 len); void bpf_stream_stage_init(struct bpf_stream_stage *ss); void bpf_stream_stage_free(struct bpf_stream_stage *ss); __printf(2, 3) |