netdev - [RFC] [PATCH bpf-next 1/1] bpf: Clear the noisy tail buffer for bpf_d

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 20 Nov 2021 13:18:39 +0800
From:   Xufeng Zhang <yunbo.xufeng@...ux.alibaba.com>
To:     jolsa@...nel.org, kpsingh@...gle.com, andriin@...com,
        ast@...nel.org, daniel@...earbox.net, bpf@...r.kernel.org,
        linux-kernel@...r.kernel.org
Cc:     netdev@...r.kernel.org, yunbo.xufeng@...ux.alibaba.com
Subject: [RFC] [PATCH bpf-next 1/1] bpf: Clear the noisy tail buffer for bpf_d_path() helper

From: "Xufeng Zhang" <yunbo.xufeng@...ux.alibaba.com>

The motivation behind this change is to use the returned full path
for lookup keys in BPF_MAP_TYPE_HASH map.
bpf_d_path() prepend the path string from the end of the input
buffer, and call memmove() to copy the full path from the tail
buffer to the head of buffer before return. So although the
returned buffer string is NULL terminated, there is still
noise data at the tail of buffer.
If using the returned full path buffer as the key of hash map,
the noise data is also calculated and makes map lookup failed.
To resolve this problem, we could memset the noisy tail buffer
before return.

Signed-off-by: Xufeng Zhang <yunbo.xufeng@...ux.alibaba.com>
---
 kernel/trace/bpf_trace.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 25ea521fb8f1..ec4a6823c024 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -903,6 +903,8 @@ BPF_CALL_3(bpf_d_path, struct path *, path, char *, buf, u32, sz)
 	} else {
 		len = buf + sz - p;
 		memmove(buf, p, len);
+		/* Clear the noisy tail buffer before return */
+		memset(buf + len, 0, sz - len);
 	}

 	return len;
-- 
2.20.1 (Apple Git-117)