linux-kernel - Re: [PATCH] potential negative index dereference fix in get_exec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9098ff24-435e-4e5b-a865-f446de933257@iogearbox.net>
Date: Thu, 12 Jun 2025 16:24:46 +0200
From: Daniel Borkmann <daniel@...earbox.net>
To: Ruslan Semchenko <uncleruc2075@...il.com>, bpf@...r.kernel.org
Cc: linux-kernel@...r.kernel.org, ast@...nel.org
Subject: Re: [PATCH] potential negative index dereference fix in
 get_exec_path()

On 6/12/25 3:18 PM, Ruslan Semchenko wrote:
> If readlink() fails, len will be -1, which can cause negative indexing
> and undefined behavior. This patch ensures that len is set to 0 on
> readlink failure, preventing such issues.
> 
> Signed-off-by: Ruslan Semchenko <uncleruc2075@...il.com>

Looks reasonable, thanks! When applying patch $subj can be tweaked into:

   "tools/bpf_jit_disasm: Fix potential negative tpath index in get_exec_path()"

(bpf-next tree is fine)

Acked-by: Daniel Borkmann <daniel@...earbox.net>

> ---
>   tools/bpf/bpf_jit_disasm.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/tools/bpf/bpf_jit_disasm.c b/tools/bpf/bpf_jit_disasm.c
> index 1baee9e2aba9..5ab8f80e2834 100644
> --- a/tools/bpf/bpf_jit_disasm.c
> +++ b/tools/bpf/bpf_jit_disasm.c
> @@ -45,6 +45,8 @@ static void get_exec_path(char *tpath, size_t size)
>   	assert(path);
>   
>   	len = readlink(path, tpath, size);
> +	if (len < 0)
> +		len = 0;
>   	tpath[len] = 0;
>   
>   	free(path);