Received-SPF: pass (google.com: domain of linux-kernel+bounces-99343-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Precedence: bulk
MIME-Version: 1.0
References: <00000000000081fb0d06135eb3ca@google.com> <tencent_E4EB1B6A2584BA2BBBB733409EAE1B524B08@qq.com>
 <5f1446d409322de91946a569edc0b836daa52aae.camel@gmail.com>
In-Reply-To: <5f1446d409322de91946a569edc0b836daa52aae.camel@gmail.com>
From: Andrii Nakryiko <andrii.nakryiko@gmail.com>
Date: Mon, 11 Mar 2024 11:01:52 -0700
Message-ID: <CAEf4BzbbvBEwy6_S1MRjiGWWfS_nxy6qNsEc0_Jdro1c10b8Vw@mail.gmail.com>
Subject: Re: [PATCH bpf-next] bpf: fix oob in btf_name_valid_section
To: Eduard Zingerman <eddyz87@gmail.com>
Cc: Edward Adam Davis <eadavis@qq.com>, syzbot+cc32304f6487ebff9b70@syzkaller.appspotmail.com, 
	andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, 
	haoluo@google.com, john.fastabend@gmail.com, jolsa@kernel.org, 
	kpsingh@kernel.org, linux-kernel@vger.kernel.org, martin.lau@linux.dev, 
	netdev@vger.kernel.org, sdf@google.com, song@kernel.org, 
	syzkaller-bugs@googlegroups.com, yonghong.song@linux.dev
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Mar 11, 2024 at 7:48=E2=80=AFAM Eduard Zingerman <eddyz87@gmail.com=
> wrote:
>
> On Mon, 2024-03-11 at 21:16 +0800, Edward Adam Davis wrote:
> > Check the first char of the BTF DATASEC names.
> >
> > Fixes: bd70a8fb7ca4 ("bpf: Allow all printable characters in BTF DATASE=
C names")
> > Reported-and-tested-by: syzbot+cc32304f6487ebff9b70@syzkaller.appspotma=
il.com
> > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > ---
> >  kernel/bpf/btf.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> > index 170d017e8e4a..dda0aa0d7175 100644
> > --- a/kernel/bpf/btf.c
> > +++ b/kernel/bpf/btf.c
> > @@ -816,6 +816,8 @@ static bool btf_name_valid_section(const struct btf=
 *btf, u32 offset)
> >       const char *src =3D btf_str_by_offset(btf, offset);
> >       const char *src_limit;
> >
> > +     if (!isprint(*src))
> > +             return false;
> >       /* set a limit on identifier length */
> >       src_limit =3D src + KSYM_NAME_LEN;
> >       src++;
>
> Hi Edward,
>
> Thank you for fixing this.
> I wonder, maybe something like below would be simpler?
>
> Thanks,
> Eduard
>
> ---
>
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 170d017e8e4a..3d95d5398c8a 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -818,7 +818,6 @@ static bool btf_name_valid_section(const struct btf *=
btf, u32 offset)
>
>         /* set a limit on identifier length */
>         src_limit =3D src + KSYM_NAME_LEN;
> -       src++;

ah, __btf_name_valid() has a separate __btf_name_char_ok(*src, true)
check and then skips first character :(

What Eduard proposes makes sense, we shouldn't advance src before the loop.

Eduard, I'd also say we should make __btf_name_valid() a bit more
uniform by dropping that first if and then doing

if (!__btf_name_char_ok(*src, src =3D=3D src_orig))
    return false;

where we just remember original string pointer in src_orig.

WDYT?


>         while (*src && src < src_limit) {
>                 if (!isprint(*src))
>                         return false;
>