[PATCH 6/7] bpf: Skip setup for zero-length string kfunc operations
From: Muhammad Usama Anjum <hidden>
Date: 2026-08-24 16:06:13
Also in:
bpf, linux-mm, lkml
Subsystem:
bpf [general] (safe dynamic programs and tools), the rest · Maintainers:
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, Linus Torvalds
A zero limit is valid for several length-bounded BPF string operations. Their loops perform no load in that case, but they still enter and leave a page-fault-disabled region. Return the existing empty result before changing page-fault state. Keep address validation first so an invalid pointer continues to return -ERANGE. Signed-off-by: Muhammad Usama Anjum <redacted> --- kernel/bpf/helpers.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index b3cc5c8fc8756..3574a9a5721ec 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c@@ -3738,6 +3738,8 @@ static int __bpf_strncasecmp(const char *s1, const char *s2, bool ignore_case, s !copy_from_kernel_nofault_allowed(s2, 1)) { return -ERANGE; } + if (!len) + return 0; guard(pagefault)(); for (i = 0; i < len && i < XATTR_SIZE_MAX; i++) {
@@ -3837,6 +3839,8 @@ __bpf_kfunc int bpf_strnchr(const char *s__ign, size_t count, char c) if (!copy_from_kernel_nofault_allowed(s__ign, 1)) return -ERANGE; + if (!count) + return -ENOENT; guard(pagefault)(); for (i = 0; i < count && i < XATTR_SIZE_MAX; i++) {
@@ -3956,6 +3960,8 @@ __bpf_kfunc int bpf_strnlen(const char *s__ign, size_t count) if (!copy_from_kernel_nofault_allowed(s__ign, 1)) return -ERANGE; + if (!count) + return 0; guard(pagefault)(); for (i = 0; i < count && i < XATTR_SIZE_MAX; i++) {
--
2.47.3