Commit eceae70b authored by Andrii Nakryiko's avatar Andrii Nakryiko Committed by Alexei Starovoitov
Browse files

selftests/bpf: Fix invalid use of strncat in test_sockmap 



strncat()'s third argument is how many bytes will be added *in addition* to
already existing bytes in destination. Plus extra zero byte will be added
after that. So existing use in test_sockmap has many opportunities to overflow
the string and cause memory corruptions. And in this case, GCC complains for
a good reason.

Fixes: 16962b24 ("bpf: sockmap, add selftests")
Fixes: 73563aa3 ("selftests/bpf: test_sockmap, print additional test options")
Fixes: 1ade9aba ("bpf: test_sockmap, add options for msg_pop_data() helper")
Fixes: 463bac5f ("bpf, selftests: Add test for ktls with skb bpf ingress policy")
Fixes: e9dd9047 ("bpf: add tls support for testing in test_sockmap")
Fixes: 753fb2ee ("bpf: sockmap, add msg_peek tests to test_sockmap")
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20201203235440.2302137-2-andrii@kernel.org
parent 3015b500

tools/testing/selftests/bpf/test_sockmap.c

+23 −13
Original line number Diff line number Diff line
@@ -1273,6 +1273,16 @@ static char *test_to_str(int test) 
	return "unknown";

}



static void append_str(char *dst, const char *src, size_t dst_cap)

{

	size_t avail = dst_cap - strlen(dst);



	if (avail <= 1) /* just zero byte could be written */

		return;



	strncat(dst, src, avail - 1); /* strncat() adds + 1 for zero byte */

}



#define OPTSTRING 60

static void test_options(char *options)

{
@@ -1281,42 +1291,42 @@ static void test_options(char *options) 
	memset(options, 0, OPTSTRING);



	if (txmsg_pass)

		strncat(options, "pass,", OPTSTRING);

		append_str(options, "pass,", OPTSTRING);

	if (txmsg_redir)

		strncat(options, "redir,", OPTSTRING);

		append_str(options, "redir,", OPTSTRING);

	if (txmsg_drop)

		strncat(options, "drop,", OPTSTRING);

		append_str(options, "drop,", OPTSTRING);

	if (txmsg_apply) {

		snprintf(tstr, OPTSTRING, "apply %d,", txmsg_apply);

		strncat(options, tstr, OPTSTRING);

		append_str(options, tstr, OPTSTRING);

	}

	if (txmsg_cork) {

		snprintf(tstr, OPTSTRING, "cork %d,", txmsg_cork);

		strncat(options, tstr, OPTSTRING);

		append_str(options, tstr, OPTSTRING);

	}

	if (txmsg_start) {

		snprintf(tstr, OPTSTRING, "start %d,", txmsg_start);

		strncat(options, tstr, OPTSTRING);

		append_str(options, tstr, OPTSTRING);

	}

	if (txmsg_end) {

		snprintf(tstr, OPTSTRING, "end %d,", txmsg_end);

		strncat(options, tstr, OPTSTRING);

		append_str(options, tstr, OPTSTRING);

	}

	if (txmsg_start_pop) {

		snprintf(tstr, OPTSTRING, "pop (%d,%d),",

			 txmsg_start_pop, txmsg_start_pop + txmsg_pop);

		strncat(options, tstr, OPTSTRING);

		append_str(options, tstr, OPTSTRING);

	}

	if (txmsg_ingress)

		strncat(options, "ingress,", OPTSTRING);

		append_str(options, "ingress,", OPTSTRING);

	if (txmsg_redir_skb)

		strncat(options, "redir_skb,", OPTSTRING);

		append_str(options, "redir_skb,", OPTSTRING);

	if (txmsg_ktls_skb)

		strncat(options, "ktls_skb,", OPTSTRING);

		append_str(options, "ktls_skb,", OPTSTRING);

	if (ktls)

		strncat(options, "ktls,", OPTSTRING);

		append_str(options, "ktls,", OPTSTRING);

	if (peek_flag)

		strncat(options, "peek,", OPTSTRING);

		append_str(options, "peek,", OPTSTRING);

}



static int __test_exec(int cgrp, int test, struct sockmap_options *opt)