Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bpf: enhance validation of pointer formatting #4684

Open
wants to merge 2 commits into
base: bpf_base
Choose a base branch
from

Commits on Nov 29, 2024

  1. bpf: fix %p% runtime check in bpf_bprintf_prepare

    Fuzzing reports a warning in format_decode()
    
    Please remove unsupported %� in format string
    WARNING: CPU: 0 PID: 5091 at lib/vsprintf.c:2680 format_decode+0x1193/0x1bb0 lib/vsprintf.c:2680
    Modules linked in:
    CPU: 0 PID: 5091 Comm: syz-executor879 Not tainted 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
    RIP: 0010:format_decode+0x1193/0x1bb0 lib/vsprintf.c:2680
    Call Trace:
     <TASK>
     bstr_printf+0x137/0x1210 lib/vsprintf.c:3253
     ____bpf_trace_printk kernel/trace/bpf_trace.c:390 [inline]
     bpf_trace_printk+0x1a1/0x230 kernel/trace/bpf_trace.c:375
     bpf_prog_21da1b68f62e1237+0x36/0x41
     bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
     __bpf_prog_run include/linux/filter.h:691 [inline]
     bpf_prog_run include/linux/filter.h:698 [inline]
     bpf_test_run+0x40b/0x910 net/bpf/test_run.c:425
     bpf_prog_test_run_skb+0xafa/0x13a0 net/bpf/test_run.c:1066
     bpf_prog_test_run+0x33c/0x3b0 kernel/bpf/syscall.c:4291
     __sys_bpf+0x48d/0x810 kernel/bpf/syscall.c:5705
     __do_sys_bpf kernel/bpf/syscall.c:5794 [inline]
     __se_sys_bpf kernel/bpf/syscall.c:5792 [inline]
     __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5792
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    
    The problem occurs when trying to pass %p% at the end of format string,
    which would result in skipping last % and passing invalid format string
    down to format_decode() that would cause warning because of invalid
    character after %.
    
    Fix issue by advancing pointer only if next char is format modifier.
    If next char is null/space/punct, then just accept formatting as is,
    without advancing the pointer.
    
    Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
    
    Reported-by: syzbot+e2c932aec5c8a6e1d31c@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=e2c932aec5c8a6e1d31c
    Fixes: 48cac3f ("bpf: Implement formatted output helpers with bstr_printf")
    Co-developed-by: Nikita Marushkin <hfggklm@gmail.com>
    Signed-off-by: Nikita Marushkin <hfggklm@gmail.com>
    Signed-off-by: Ilya Shchipletsov <rabbelkin@mail.ru>
    Acked-by: Yonghong Song <yonghong.song@linux.dev>
    Acked-by: Florent Revest <revest@chromium.org>
    Ilya Shchipletsov authored and Kernel Patches Daemon committed Nov 29, 2024
    Configuration menu
    Copy the full SHA
    ed93e12 View commit details
    Browse the repository at this point in the history
  2. selftests/bpf: Add test cases for various pointer specifiers

    Extend snprintf negative tests to cover pointer specifiers to prevent
    possible invalid handling of %p% from happening again.
    
     ./test_progs -t snprintf
     #302/1   snprintf/snprintf_positive:OK
     #302/2   snprintf/snprintf_negative:OK
     #302     snprintf:OK
     #303     snprintf_btf:OK
     Summary: 2/2 PASSED, 0 SKIPPED, 0 FAILED
    
    Co-developed-by: Nikita Marushkin <hfggklm@gmail.com>
    Signed-off-by: Nikita Marushkin <hfggklm@gmail.com>
    Signed-off-by: Ilya Shchipletsov <rabbelkin@mail.ru>
    Acked-by: Yonghong Song <yonghong.song@linux.dev>
    Acked-by: Florent Revest <revest@chromium.org>
    Ilya Shchipletsov authored and Kernel Patches Daemon committed Nov 29, 2024
    Configuration menu
    Copy the full SHA
    038336b View commit details
    Browse the repository at this point in the history