From 14e5342e996ff122875a2306ba8d84dac096a48a Mon Sep 17 00:00:00 2001
From: "Dmitry V. Levin" <ldv@altlinux.org>
Date: Thu, 3 Jan 2019 23:36:22 +0000
Subject: [PATCH 15/27] tests: use tail_alloc instead of calloc in
bpf-obj_get_info_by_fd-prog*
This guarantees that map_info and prog_info objects are not accessed
out of bounds.
* tests/bpf-obj_get_info_by_fd.c: Include <string.h>.
(main): Use tail_alloc instead of calloc for map_info and prog_info.
Conflicts:
tests/bpf-obj_get_info_by_fd.c
Additional changes:
tests-m32/bpf-obj_get_info_by_fd.c (copy of tests/bpf-obj_get_info_by_fd.c)
tests-mx32/bpf-obj_get_info_by_fd.c (copy of tests/bpf-obj_get_info_by_fd.c)
---
tests/bpf-obj_get_info_by_fd.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
Index: strace-4.24/tests/bpf-obj_get_info_by_fd.c
===================================================================
--- strace-4.24.orig/tests/bpf-obj_get_info_by_fd.c 2019-03-10 05:19:26.164412164 +0100
+++ strace-4.24/tests/bpf-obj_get_info_by_fd.c 2019-03-10 05:35:03.618024803 +0100
@@ -18,6 +18,7 @@
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
+#include <string.h>
#include <unistd.h>
#include <sys/sysmacros.h>
#include <asm/unistd.h>
@@ -274,13 +275,14 @@
* initializer element is not constant.
*/
#define MAP_INFO_SZ (sizeof(*map_info) + 64)
- struct bpf_map_info_struct *map_info = calloc(1, MAP_INFO_SZ);
+ struct bpf_map_info_struct *map_info = tail_alloc(MAP_INFO_SZ);
struct BPF_OBJ_GET_INFO_BY_FD_struct bpf_map_get_info_attr = {
.bpf_fd = map_fd,
.info_len = MAP_INFO_SZ,
.info = (uintptr_t) map_info,
};
+ memset(map_info, 0, MAP_INFO_SZ);
int ret = sys_bpf(BPF_OBJ_GET_INFO_BY_FD, &bpf_map_get_info_attr,
sizeof(bpf_map_get_info_attr));
if (ret < 0)
@@ -330,7 +332,7 @@
* initializer element is not constant.
*/
#define PROG_INFO_SZ (sizeof(*prog_info) + 64)
- struct bpf_prog_info_struct *prog_info = calloc(1, PROG_INFO_SZ);
+ struct bpf_prog_info_struct *prog_info = tail_alloc(PROG_INFO_SZ);
struct bpf_insn *xlated_prog = tail_alloc(sizeof(*xlated_prog) * 42);
uint32_t *map_ids = tail_alloc(sizeof(*map_ids) * 2);
struct BPF_OBJ_GET_INFO_BY_FD_struct bpf_prog_get_info_attr = {
@@ -340,6 +342,7 @@
};
size_t old_prog_info_len = PROG_INFO_SZ;
+ memset(prog_info, 0, PROG_INFO_SZ);
for (unsigned int i = 0; i < 4; i++) {
prog_info->jited_prog_len = 0;
switch (i) {
Index: strace-4.24/tests-m32/bpf-obj_get_info_by_fd.c
===================================================================
--- strace-4.24.orig/tests-m32/bpf-obj_get_info_by_fd.c 2018-06-04 03:11:05.000000000 +0200
+++ strace-4.24/tests-m32/bpf-obj_get_info_by_fd.c 2019-03-10 05:35:43.934621086 +0100
@@ -4,27 +4,7 @@
* Copyright (c) 2018 The strace developers.
* All rights reserved.
*
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote products
- * derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * SPDX-License-Identifier: GPL-2.0-or-later
*/
#include "tests.h"
@@ -38,6 +18,7 @@
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
+#include <string.h>
#include <unistd.h>
#include <sys/sysmacros.h>
#include <asm/unistd.h>
@@ -294,13 +275,14 @@
* initializer element is not constant.
*/
#define MAP_INFO_SZ (sizeof(*map_info) + 64)
- struct bpf_map_info_struct *map_info = calloc(1, MAP_INFO_SZ);
+ struct bpf_map_info_struct *map_info = tail_alloc(MAP_INFO_SZ);
struct BPF_OBJ_GET_INFO_BY_FD_struct bpf_map_get_info_attr = {
.bpf_fd = map_fd,
.info_len = MAP_INFO_SZ,
.info = (uintptr_t) map_info,
};
+ memset(map_info, 0, MAP_INFO_SZ);
int ret = sys_bpf(BPF_OBJ_GET_INFO_BY_FD, &bpf_map_get_info_attr,
sizeof(bpf_map_get_info_attr));
if (ret < 0)
@@ -350,7 +332,7 @@
* initializer element is not constant.
*/
#define PROG_INFO_SZ (sizeof(*prog_info) + 64)
- struct bpf_prog_info_struct *prog_info = calloc(1, PROG_INFO_SZ);
+ struct bpf_prog_info_struct *prog_info = tail_alloc(PROG_INFO_SZ);
struct bpf_insn *xlated_prog = tail_alloc(sizeof(*xlated_prog) * 42);
uint32_t *map_ids = tail_alloc(sizeof(*map_ids) * 2);
struct BPF_OBJ_GET_INFO_BY_FD_struct bpf_prog_get_info_attr = {
@@ -360,6 +342,7 @@
};
size_t old_prog_info_len = PROG_INFO_SZ;
+ memset(prog_info, 0, PROG_INFO_SZ);
for (unsigned int i = 0; i < 4; i++) {
prog_info->jited_prog_len = 0;
switch (i) {
Index: strace-4.24/tests-mx32/bpf-obj_get_info_by_fd.c
===================================================================
--- strace-4.24.orig/tests-mx32/bpf-obj_get_info_by_fd.c 2018-06-04 03:11:05.000000000 +0200
+++ strace-4.24/tests-mx32/bpf-obj_get_info_by_fd.c 2019-03-10 05:35:48.837571989 +0100
@@ -4,27 +4,7 @@
* Copyright (c) 2018 The strace developers.
* All rights reserved.
*
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote products
- * derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * SPDX-License-Identifier: GPL-2.0-or-later
*/
#include "tests.h"
@@ -38,6 +18,7 @@
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
+#include <string.h>
#include <unistd.h>
#include <sys/sysmacros.h>
#include <asm/unistd.h>
@@ -294,13 +275,14 @@
* initializer element is not constant.
*/
#define MAP_INFO_SZ (sizeof(*map_info) + 64)
- struct bpf_map_info_struct *map_info = calloc(1, MAP_INFO_SZ);
+ struct bpf_map_info_struct *map_info = tail_alloc(MAP_INFO_SZ);
struct BPF_OBJ_GET_INFO_BY_FD_struct bpf_map_get_info_attr = {
.bpf_fd = map_fd,
.info_len = MAP_INFO_SZ,
.info = (uintptr_t) map_info,
};
+ memset(map_info, 0, MAP_INFO_SZ);
int ret = sys_bpf(BPF_OBJ_GET_INFO_BY_FD, &bpf_map_get_info_attr,
sizeof(bpf_map_get_info_attr));
if (ret < 0)
@@ -350,7 +332,7 @@
* initializer element is not constant.
*/
#define PROG_INFO_SZ (sizeof(*prog_info) + 64)
- struct bpf_prog_info_struct *prog_info = calloc(1, PROG_INFO_SZ);
+ struct bpf_prog_info_struct *prog_info = tail_alloc(PROG_INFO_SZ);
struct bpf_insn *xlated_prog = tail_alloc(sizeof(*xlated_prog) * 42);
uint32_t *map_ids = tail_alloc(sizeof(*map_ids) * 2);
struct BPF_OBJ_GET_INFO_BY_FD_struct bpf_prog_get_info_attr = {
@@ -360,6 +342,7 @@
};
size_t old_prog_info_len = PROG_INFO_SZ;
+ memset(prog_info, 0, PROG_INFO_SZ);
for (unsigned int i = 0; i < 4; i++) {
prog_info->jited_prog_len = 0;
switch (i) {