Skip to content

Bugs in bpf_prog_test_run_opts() #4441

Open
@saxena-anurag

Description

@saxena-anurag

There are couple of issues with the current bpf_prog_test_run_opts() API implementation:

  1. In the case when ctx_in passed to the above API is not NULL but ctx_out is NULL (which seems to be a valid scenario), ebpfcore assumes that the ctx_out is also not NULL (and of the same size as ctx_in), and overwrites the data in the data_out with ctx_out, corrupting the value in data_out. There is no buffer overflow, but data_out is corrupted.
  2. In the case when data_out buffer size provider by user mode app is more than actual data_out returned by extension after BPF program invocation, ebpfcore ignores the initial data_out size, and starts copying ctx_out in the data_out buffer.

Metadata

Metadata

Assignees

Labels

P3bugSomething isn't workingtriagedDiscussed in a triage meeting

Type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions