Re: [PATCH 14/21] selftests/exec: test the transparent binfmt_misc mode

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Stack-based buffer overflow in binfmt_transparent_interp when concatenating strings into the `expect` array.
--

--- Patch [14]: [PATCH 14/21] selftests/exec: test the transparent binfmt_misc mode ---
commit 9d915ef86186ae5a0a73c74e07d46a93d08f7fe5
Author: Christian Brauner <brauner@kernel.org>

selftests/exec: test the transparent binfmt_misc mode

This commit introduces a transparent dispatch test for binfmt_misc from both
activation paths. The dispatch routes to a shared asserting interpreter that
validates the kernel's constructed identity from inside the process.

> diff --git a/tools/testing/selftests/exec/binfmt_transparent_interp.c b/tools/testing/selftests/exec/binfmt_transparent_interp.c
> new file mode 100644
> index 0000000000000..2a71c47067582
> --- /dev/null
> +++ b/tools/testing/selftests/exec/binfmt_transparent_interp.c
> @@ -0,0 +1,130 @@
[ ... ]
> +int main(int argc, char **argv)
> +{
> +	const char *binary = getenv("BINFMT_TEST_BINARY");
> +	const char *argv0 = getenv("BINFMT_TEST_ARGV0");
> +	char exe[PATH_MAX], real[PATH_MAX], buf[PATH_MAX];
> +	char expect[PATH_MAX + 32];
[ ... ]
> +	/* Distinct from the binary path, so a classic argv splice is caught. */
> +	want[0] = argv0 ? argv0 : binary;
> +	want[1] = "argone";
> +	want[2] = "argtwo";
[ ... ]
> +	/* And so did the kernel's copy of it: the same strings, NUL separated. */
> +	for (i = 0, expect_len = 0; i < ARRAY_SIZE(want); i++) {
> +		size_t len = strlen(want[i]) + 1;
> +
> +		memcpy(expect + expect_len, want[i], len);

[Severity: Medium]
Could this overflow the expect[] buffer?

If the user executes this test program with BINFMT_TEST_ARGV0 or 
BINFMT_TEST_BINARY set to a string longer than PATH_MAX, expect_len + len 
could exceed the size of the expect[] buffer. Since there is no bounds 
checking before the memcpy(), this would result in a stack-based buffer 
overflow.

> +		expect_len += len;
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720-work-bpf-binfmt_misc-ptinterp-v1-0-ddb76c9a508e@kernel.org?part=14