[PATCH 6/7] bpf: Skip setup for zero-length string kfunc operations
Muhammad Usama Anjum <[email protected]>
| Newsgroups | org.kvack.linux-mm,org.infradead.lists.linux-arm-kernel,org.kernel.vger.bpf,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
A zero limit is valid for several length-bounded BPF string operations. Their loops perform no load in that case, but they still enter and leave a page-fault-disabled region. Return the existing empty result before changing page-fault state. Keep address validation first so an invalid pointer continues to return -ERANGE. Signed-off-by: Muhammad Usama Anjum <[email protected]> --- kernel/bpf/helpers.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index b3cc5c8fc8756..3574a9a5721ec 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -3738,6 +3738,8 @@ static int __bpf_strncasecmp(const char *s1, const char *s2, bool ignore_case, s !copy_from_kernel_nofault_allowed(s2, 1)) { return -ERANGE; } + if (!len) + return 0; guard(pagefault)(); for (i = 0; i < len && i < XATTR_SIZE_MAX; i++) { @@ -3837,6 +3839,8 @@ __bpf_kfunc int bpf_strnchr(const char *s__ign, size_t count, char c) if (!copy_from_kernel_nofault_allowed(s__ign, 1)) return -ERANGE; + if (!count) + return -ENOENT; guard(pagefault)(); for (i = 0; i < count && i < XATTR_SIZE_MAX; i++) { @@ -3956,6 +3960,8 @@ __bpf_kfunc int bpf_strnlen(const char *s__ign, size_t count) if (!copy_from_kernel_nofault_allowed(s__ign, 1)) return -ERANGE; + if (!count) + return 0; guard(pagefault)(); for (i = 0; i < count && i < XATTR_SIZE_MAX; i++) { -- 2.47.3