From: Andrii Nakryiko <andrii@kernel.org>
To: <bpf@vger.kernel.org>, <netdev@vger.kernel.org>, <ast@fb.com>,
<daniel@iogearbox.net>
Cc: <andrii@kernel.org>, <kernel-team@fb.com>
Subject: [PATCH bpf-next 2/2] selftests/bpf: fix invalid use of strncat in test_sockmap
Date: Thu, 3 Dec 2020 15:54:40 -0800 [thread overview]
Message-ID: <20201203235440.2302137-2-andrii@kernel.org> (raw)
In-Reply-To: <20201203235440.2302137-1-andrii@kernel.org>
strncat()'s third argument is how many bytes will be added *in addition* to
already existing bytes in destination. Plus extra zero byte will be added
after that. So existing use in test_sockmap has many opportunities to overflow
the string and cause memory corruptions. And in this case, GCC complains for
a good reason.
Fixes: 16962b2404ac ("bpf: sockmap, add selftests")
Fixes: 73563aa3d977 ("selftests/bpf: test_sockmap, print additional test options")
Fixes: 1ade9abadfca ("bpf: test_sockmap, add options for msg_pop_data() helper")
Fixes: 463bac5f1ca7 ("bpf, selftests: Add test for ktls with skb bpf ingress policy")
Fixes: e9dd904708c4 ("bpf: add tls support for testing in test_sockmap")
Fixes: 753fb2ee0934 ("bpf: sockmap, add msg_peek tests to test_sockmap")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---
tools/testing/selftests/bpf/test_sockmap.c | 36 ++++++++++++++--------
1 file changed, 23 insertions(+), 13 deletions(-)
diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
index 0fa1e421c3d7..427ca00a3217 100644
--- a/tools/testing/selftests/bpf/test_sockmap.c
+++ b/tools/testing/selftests/bpf/test_sockmap.c
@@ -1273,6 +1273,16 @@ static char *test_to_str(int test)
return "unknown";
}
+static void append_str(char *dst, const char *src, size_t dst_cap)
+{
+ size_t avail = dst_cap - strlen(dst);
+
+ if (avail <= 1) /* just zero byte could be written */
+ return;
+
+ strncat(dst, src, avail - 1); /* strncat() adds + 1 for zero byte */
+}
+
#define OPTSTRING 60
static void test_options(char *options)
{
@@ -1281,42 +1291,42 @@ static void test_options(char *options)
memset(options, 0, OPTSTRING);
if (txmsg_pass)
- strncat(options, "pass,", OPTSTRING);
+ append_str(options, "pass,", OPTSTRING);
if (txmsg_redir)
- strncat(options, "redir,", OPTSTRING);
+ append_str(options, "redir,", OPTSTRING);
if (txmsg_drop)
- strncat(options, "drop,", OPTSTRING);
+ append_str(options, "drop,", OPTSTRING);
if (txmsg_apply) {
snprintf(tstr, OPTSTRING, "apply %d,", txmsg_apply);
- strncat(options, tstr, OPTSTRING);
+ append_str(options, tstr, OPTSTRING);
}
if (txmsg_cork) {
snprintf(tstr, OPTSTRING, "cork %d,", txmsg_cork);
- strncat(options, tstr, OPTSTRING);
+ append_str(options, tstr, OPTSTRING);
}
if (txmsg_start) {
snprintf(tstr, OPTSTRING, "start %d,", txmsg_start);
- strncat(options, tstr, OPTSTRING);
+ append_str(options, tstr, OPTSTRING);
}
if (txmsg_end) {
snprintf(tstr, OPTSTRING, "end %d,", txmsg_end);
- strncat(options, tstr, OPTSTRING);
+ append_str(options, tstr, OPTSTRING);
}
if (txmsg_start_pop) {
snprintf(tstr, OPTSTRING, "pop (%d,%d),",
txmsg_start_pop, txmsg_start_pop + txmsg_pop);
- strncat(options, tstr, OPTSTRING);
+ append_str(options, tstr, OPTSTRING);
}
if (txmsg_ingress)
- strncat(options, "ingress,", OPTSTRING);
+ append_str(options, "ingress,", OPTSTRING);
if (txmsg_redir_skb)
- strncat(options, "redir_skb,", OPTSTRING);
+ append_str(options, "redir_skb,", OPTSTRING);
if (txmsg_ktls_skb)
- strncat(options, "ktls_skb,", OPTSTRING);
+ append_str(options, "ktls_skb,", OPTSTRING);
if (ktls)
- strncat(options, "ktls,", OPTSTRING);
+ append_str(options, "ktls,", OPTSTRING);
if (peek_flag)
- strncat(options, "peek,", OPTSTRING);
+ append_str(options, "peek,", OPTSTRING);
}
static int __test_exec(int cgrp, int test, struct sockmap_options *opt)
--
2.24.1
prev parent reply other threads:[~2020-12-03 23:55 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-03 23:54 [PATCH bpf-next 1/2] libbpf: use memcpy instead of strncpy to please GCC Andrii Nakryiko
2020-12-03 23:54 ` Andrii Nakryiko [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201203235440.2302137-2-andrii@kernel.org \
--to=andrii@kernel.org \
--cc=ast@fb.com \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=kernel-team@fb.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).