maccess: Fix writing offset in case of fault in strncpy_from_kernel_nofault()
commit 8678ea06852cd1f819b870c773d43df888d15d46 upstream.
If a page fault occurs while copying the first byte, this function resets one
byte before dst.
As a consequence, an address could be modified and leaded to kernel crashes if
case the modified address was accessed later.
Fixes: b58294ead14c ("maccess: allow architectures to provide kernel probing directly")
Signed-off-by: Alban Crequy <[email protected]>
Signed-off-by: Andrii Nakryiko <[email protected]>
Tested-by: Francis Laniel <[email protected]>
Reviewed-by: Andrew Morton <[email protected]>
Cc: <[email protected]> [5.8]
Link: https://lore.kernel.org/bpf/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 file changed
