Commit 1efb6ee3 authored Nov 23, 2018 by Martynas Pumputis Committed by Daniel Borkmann Nov 23, 2018

bpf: fix check of allowed specifiers in bpf_trace_printk



A format string consisting of "%p" or "%s" followed by an invalid
specifier (e.g. "%p%\n" or "%s%") could pass the check which
would make format_decode (lib/vsprintf.c) to warn.

Fixes: 9c959c86 ("tracing: Allow BPF programs to call bpf_trace_printk()")
Reported-by:  <syzbot+1ec5c5ec949c4adaa0c4@syzkaller.appspotmail.com>
Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

parent 813961de

kernel/trace/bpf_trace.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -196,11 +196,13 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
		i++;
		} else if (fmt[i] == 'p' \|\| fmt[i] == 's') {
		mod[fmt_cnt]++;
		i++;
		if (!isspace(fmt[i]) && !ispunct(fmt[i]) && fmt[i] != 0)
		/* disallow any further format extensions */
		if (fmt[i + 1] != 0 &&
		!isspace(fmt[i + 1]) &&
		!ispunct(fmt[i + 1]))
		return -EINVAL;
		fmt_cnt++;
		if (fmt[i - 1] == 's') {
		if (fmt[i] == 's') {
		if (str_seen)
		/* allow only one '%s' per fmt string */
		return -EINVAL;