From 14e5342e996ff122875a2306ba8d84dac096a48a Mon Sep 17 00:00:00 2001 From: "Dmitry V. Levin" Date: Thu, 3 Jan 2019 23:36:22 +0000 Subject: [PATCH 15/27] tests: use tail_alloc instead of calloc in bpf-obj_get_info_by_fd-prog* This guarantees that map_info and prog_info objects are not accessed out of bounds. * tests/bpf-obj_get_info_by_fd.c: Include . (main): Use tail_alloc instead of calloc for map_info and prog_info. Conflicts: tests/bpf-obj_get_info_by_fd.c Additional changes: tests-m32/bpf-obj_get_info_by_fd.c (copy of tests/bpf-obj_get_info_by_fd.c) tests-mx32/bpf-obj_get_info_by_fd.c (copy of tests/bpf-obj_get_info_by_fd.c) --- tests/bpf-obj_get_info_by_fd.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) Index: strace-4.24/tests/bpf-obj_get_info_by_fd.c =================================================================== --- strace-4.24.orig/tests/bpf-obj_get_info_by_fd.c 2019-03-10 05:19:26.164412164 +0100 +++ strace-4.24/tests/bpf-obj_get_info_by_fd.c 2019-03-10 05:35:03.618024803 +0100 @@ -18,6 +18,7 @@ #include #include #include +#include #include #include #include @@ -274,13 +275,14 @@ * initializer element is not constant. */ #define MAP_INFO_SZ (sizeof(*map_info) + 64) - struct bpf_map_info_struct *map_info = calloc(1, MAP_INFO_SZ); + struct bpf_map_info_struct *map_info = tail_alloc(MAP_INFO_SZ); struct BPF_OBJ_GET_INFO_BY_FD_struct bpf_map_get_info_attr = { .bpf_fd = map_fd, .info_len = MAP_INFO_SZ, .info = (uintptr_t) map_info, }; + memset(map_info, 0, MAP_INFO_SZ); int ret = sys_bpf(BPF_OBJ_GET_INFO_BY_FD, &bpf_map_get_info_attr, sizeof(bpf_map_get_info_attr)); if (ret < 0) @@ -330,7 +332,7 @@ * initializer element is not constant. */ #define PROG_INFO_SZ (sizeof(*prog_info) + 64) - struct bpf_prog_info_struct *prog_info = calloc(1, PROG_INFO_SZ); + struct bpf_prog_info_struct *prog_info = tail_alloc(PROG_INFO_SZ); struct bpf_insn *xlated_prog = tail_alloc(sizeof(*xlated_prog) * 42); uint32_t *map_ids = tail_alloc(sizeof(*map_ids) * 2); struct BPF_OBJ_GET_INFO_BY_FD_struct bpf_prog_get_info_attr = { @@ -340,6 +342,7 @@ }; size_t old_prog_info_len = PROG_INFO_SZ; + memset(prog_info, 0, PROG_INFO_SZ); for (unsigned int i = 0; i < 4; i++) { prog_info->jited_prog_len = 0; switch (i) { Index: strace-4.24/tests-m32/bpf-obj_get_info_by_fd.c =================================================================== --- strace-4.24.orig/tests-m32/bpf-obj_get_info_by_fd.c 2018-06-04 03:11:05.000000000 +0200 +++ strace-4.24/tests-m32/bpf-obj_get_info_by_fd.c 2019-03-10 05:35:43.934621086 +0100 @@ -4,27 +4,7 @@ * Copyright (c) 2018 The strace developers. * All rights reserved. * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. The name of the author may not be used to endorse or promote products - * derived from this software without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR - * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. - * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, - * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF - * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * SPDX-License-Identifier: GPL-2.0-or-later */ #include "tests.h" @@ -38,6 +18,7 @@ #include #include #include +#include #include #include #include @@ -294,13 +275,14 @@ * initializer element is not constant. */ #define MAP_INFO_SZ (sizeof(*map_info) + 64) - struct bpf_map_info_struct *map_info = calloc(1, MAP_INFO_SZ); + struct bpf_map_info_struct *map_info = tail_alloc(MAP_INFO_SZ); struct BPF_OBJ_GET_INFO_BY_FD_struct bpf_map_get_info_attr = { .bpf_fd = map_fd, .info_len = MAP_INFO_SZ, .info = (uintptr_t) map_info, }; + memset(map_info, 0, MAP_INFO_SZ); int ret = sys_bpf(BPF_OBJ_GET_INFO_BY_FD, &bpf_map_get_info_attr, sizeof(bpf_map_get_info_attr)); if (ret < 0) @@ -350,7 +332,7 @@ * initializer element is not constant. */ #define PROG_INFO_SZ (sizeof(*prog_info) + 64) - struct bpf_prog_info_struct *prog_info = calloc(1, PROG_INFO_SZ); + struct bpf_prog_info_struct *prog_info = tail_alloc(PROG_INFO_SZ); struct bpf_insn *xlated_prog = tail_alloc(sizeof(*xlated_prog) * 42); uint32_t *map_ids = tail_alloc(sizeof(*map_ids) * 2); struct BPF_OBJ_GET_INFO_BY_FD_struct bpf_prog_get_info_attr = { @@ -360,6 +342,7 @@ }; size_t old_prog_info_len = PROG_INFO_SZ; + memset(prog_info, 0, PROG_INFO_SZ); for (unsigned int i = 0; i < 4; i++) { prog_info->jited_prog_len = 0; switch (i) { Index: strace-4.24/tests-mx32/bpf-obj_get_info_by_fd.c =================================================================== --- strace-4.24.orig/tests-mx32/bpf-obj_get_info_by_fd.c 2018-06-04 03:11:05.000000000 +0200 +++ strace-4.24/tests-mx32/bpf-obj_get_info_by_fd.c 2019-03-10 05:35:48.837571989 +0100 @@ -4,27 +4,7 @@ * Copyright (c) 2018 The strace developers. * All rights reserved. * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. The name of the author may not be used to endorse or promote products - * derived from this software without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR - * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. - * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, - * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF - * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * SPDX-License-Identifier: GPL-2.0-or-later */ #include "tests.h" @@ -38,6 +18,7 @@ #include #include #include +#include #include #include #include @@ -294,13 +275,14 @@ * initializer element is not constant. */ #define MAP_INFO_SZ (sizeof(*map_info) + 64) - struct bpf_map_info_struct *map_info = calloc(1, MAP_INFO_SZ); + struct bpf_map_info_struct *map_info = tail_alloc(MAP_INFO_SZ); struct BPF_OBJ_GET_INFO_BY_FD_struct bpf_map_get_info_attr = { .bpf_fd = map_fd, .info_len = MAP_INFO_SZ, .info = (uintptr_t) map_info, }; + memset(map_info, 0, MAP_INFO_SZ); int ret = sys_bpf(BPF_OBJ_GET_INFO_BY_FD, &bpf_map_get_info_attr, sizeof(bpf_map_get_info_attr)); if (ret < 0) @@ -350,7 +332,7 @@ * initializer element is not constant. */ #define PROG_INFO_SZ (sizeof(*prog_info) + 64) - struct bpf_prog_info_struct *prog_info = calloc(1, PROG_INFO_SZ); + struct bpf_prog_info_struct *prog_info = tail_alloc(PROG_INFO_SZ); struct bpf_insn *xlated_prog = tail_alloc(sizeof(*xlated_prog) * 42); uint32_t *map_ids = tail_alloc(sizeof(*map_ids) * 2); struct BPF_OBJ_GET_INFO_BY_FD_struct bpf_prog_get_info_attr = { @@ -360,6 +342,7 @@ }; size_t old_prog_info_len = PROG_INFO_SZ; + memset(prog_info, 0, PROG_INFO_SZ); for (unsigned int i = 0; i < 4; i++) { prog_info->jited_prog_len = 0; switch (i) {