According to the context in bpf_bprintf_prepare(), this is checking if fmt ends with a NUL word. Therefore, strnchrnul() should be used for validation instead of strnchr(). Reported-by: syzbot+9b8be5e35747291236c8@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Edward Adam Davis <eadavis@xxxxxx> --- kernel/bpf/helpers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index 449b9a5d3fe3..07490eba24fe 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -826,7 +826,7 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args, u64 cur_arg; char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX"; - fmt_end = strnchr(fmt, fmt_size, 0); + fmt_end = strnchrnul(fmt, fmt_size, 0); if (!fmt_end) return -EINVAL; fmt_size = fmt_end - fmt; -- 2.43.0
