Merge branch 'Fix bpf_probe_read_user_str() overcopying'

Browse source

Daniel Xu says:

====================

6ae08ae3de ("bpf: Add probe_read_{user, kernel} and probe_read_{user,
kernel}_str helpers") introduced a subtle bug where
bpf_probe_read_user_str() would potentially copy a few extra bytes after
the NUL terminator.

This issue is particularly nefarious when strings are used as map keys,
as seemingly identical strings can occupy multiple entries in a map.

This patchset fixes the issue and introduces a selftest to prevent
future regressions.

v6 -> v7:
* Add comments

v5 -> v6:
* zero-pad up to sizeof(unsigned long) after NUL

v4 -> v5:
* don't read potentially uninitialized memory

v3 -> v4:
* directly pass userspace pointer to prog
* test more strings of different length

v2 -> v3:
* set pid filter before attaching prog in selftest
* use long instead of int as bpf_probe_read_user_str() retval
* style changes

v1 -> v2:
* add Fixes: tag
* add selftest
====================

Signed-off-by: Alexei Starovoitov <ast@kernel.org>

...

This commit is contained in:

Alexei Starovoitov 2020-11-19 10:45:55 -08:00

parent 1fd6cee127 c8a36aedf3

commit 14d6d86c21

4 changed files with 123 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

10

kernel/trace/bpf_trace.c

View file

19

lib/strncpy_from_user.c

View file

71

tools/testing/selftests/bpf/prog_tests/probe_read_user_str.c

View file

25

tools/testing/selftests/bpf/progs/test_probe_read_user_str.c

View file