linux-kernel - Re: [PATCH bpf-next] bpf/helpers: bpf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4BzaMUEPjix29JjiYCt1JmWcz97gemSpXL9iD9Gc-g+yZYw@mail.gmail.com>
Date: Wed, 27 Aug 2025 15:35:19 -0700
From: Andrii Nakryiko <andrii.nakryiko@...il.com>
To: Rong Tao <rtoax@...mail.com>, Viktor Malik <vmalik@...hat.com>
Cc: ast@...nel.org, daniel@...earbox.net, rongtao@...tc.cn, 
	Andrii Nakryiko <andrii@...nel.org>, Martin KaFai Lau <martin.lau@...ux.dev>, 
	Eduard Zingerman <eddyz87@...il.com>, Song Liu <song@...nel.org>, 
	Yonghong Song <yonghong.song@...ux.dev>, John Fastabend <john.fastabend@...il.com>, 
	KP Singh <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>, 
	Jiri Olsa <jolsa@...nel.org>, 
	"open list:BPF [GENERAL] (Safe Dynamic Programs and Tools)" <bpf@...r.kernel.org>, open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf-next] bpf/helpers: bpf_strnstr: Exact match length

cc'ing Viktor as well

On Tue, Aug 26, 2025 at 9:29 PM Rong Tao <rtoax@...mail.com> wrote:
>
> From: Rong Tao <rongtao@...tc.cn>
>
> strnstr should not treat the ending '\0' of s2 as a matching character,
> otherwise the parameter 'len' will be meaningless, for example:
>
>     1. bpf_strnstr("openat", "open", 4) = -ENOENT
>     2. bpf_strnstr("openat", "open", 5) = 0

please add these cases to the tests

>
> This patch makes (1) return 0, indicating a successful match.
>
> Signed-off-by: Rong Tao <rongtao@...tc.cn>
> ---
>  kernel/bpf/helpers.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> index 401b4932cc49..65bd0050c560 100644
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
> @@ -3681,6 +3681,8 @@ __bpf_kfunc int bpf_strnstr(const char *s1__ign, const char *s2__ign, size_t len
>                                 return -ENOENT;
>                         if (c1 != c2)
>                                 break;
> +                       if (j == len - 1)
> +                               return i;

But this seems like a wrong fix. The API assumes that s2 is
well-formed zero-terminated string, and so we shouldn't just randomly
truncate it. Along the examples above, what will happen to
bpf_strnstr("openat", "open", 3)? With your fix it will return
success, right? But it shouldn't, IMO, because "open" wasn't really
found in the first 3 characters of, effectively, "ope".

We should also test bpf_strnstr("", "", 0)... ;)


So maybe something like this (but I haven't really tested it):


diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 401b4932cc49..ced7132980fe 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -3672,10 +3672,12 @@ __bpf_kfunc int bpf_strnstr(const char
*s1__ign, const char *s2__ign, size_t len

        guard(pagefault)();
        for (i = 0; i < XATTR_SIZE_MAX; i++) {
-               for (j = 0; i + j < len && j < XATTR_SIZE_MAX; j++) {
+               for (j = 0; i + j <= len && j < XATTR_SIZE_MAX; j++) {
                        __get_kernel_nofault(&c2, s2__ign + j, char, err_out);
                        if (c2 == '\0')
                                return i;
+                       if (i + j == len)
+                               break;
                        __get_kernel_nofault(&c1, s1__ign + j, char, err_out);
                        if (c1 == '\0')
                                return -ENOENT;


pw-bot: cr


>                 }
>                 if (j == XATTR_SIZE_MAX)
>                         return -E2BIG;
> --
> 2.51.0
>
>