Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpf: enhance validation of pointer formatting #4684

Open
wants to merge 2 commits into
base: bpf_base
Choose a base branch
from
+24 −4
Open

bpf: enhance validation of pointer formatting #4684

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ad6b2e9
bpf: fix %p% runtime check in bpf_bprintf_prepare
Nov 19, 2024
604ff7a
selftests/bpf: Add test cases for various pointer specifiers
Nov 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions kernel/bpf/helpers.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -889,17 +889,22 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args,
goto fmt_str;
}

if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) ||
ispunct(fmt[i + 1]) || fmt[i + 1] == 'K' ||
fmt[i + 1] == 'x' || fmt[i + 1] == 's' ||
fmt[i + 1] == 'S') {
if (fmt[i + 1] == 'K' || fmt[i + 1] == 'x' ||
fmt[i + 1] == 's' || fmt[i + 1] == 'S') {
/* just kernel pointers */
if (tmp_buf)
cur_arg = raw_args[num_spec];
i++;
goto nocopy_fmt;
}

if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) ||
ispunct(fmt[i + 1])) {
if (tmp_buf)
cur_arg = raw_args[num_spec];
goto nocopy_fmt;
}

if (fmt[i + 1] == 'B') {
if (tmp_buf) {
err = snprintf(tmp_buf,
Expand Down
15 changes: 15 additions & 0 deletions tools/testing/selftests/bpf/prog_tests/snprintf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,21 @@ static void test_snprintf_negative(void)
ASSERT_ERR(load_single_snprintf("%llc"), "invalid specifier 7");
ASSERT_ERR(load_single_snprintf("\x80"), "non ascii character");
ASSERT_ERR(load_single_snprintf("\x1"), "non printable character");

ASSERT_OK(load_single_snprintf("valid %p"), "valid usage");

ASSERT_ERR(load_single_snprintf("%p%"), "too many specifiers 1");
ASSERT_ERR(load_single_snprintf("%pK%"), "too many specifiers 2");
ASSERT_ERR(load_single_snprintf("%px%"), "too many specifiers 3");
ASSERT_ERR(load_single_snprintf("%ps%"), "too many specifiers 4");
ASSERT_ERR(load_single_snprintf("%pS%"), "too many specifiers 5");
ASSERT_ERR(load_single_snprintf("%pB%"), "too many specifiers 6");
ASSERT_ERR(load_single_snprintf("%pi4%"), "too many specifiers 7");
ASSERT_ERR(load_single_snprintf("%pI4%"), "too many specifiers 8");
ASSERT_ERR(load_single_snprintf("%pi6%"), "too many specifiers 9");
ASSERT_ERR(load_single_snprintf("%pI6%"), "too many specifiers 10");
ASSERT_ERR(load_single_snprintf("%pks%"), "too many specifiers 11");
ASSERT_ERR(load_single_snprintf("%pus%"), "too many specifiers 12");
}

void test_snprintf(void)
Expand Down
Loading