[PATCH 14/20] test: detect strlen corruption of strtab rodata and zeros

[PATCH 14/20] test: detect strlen corruption of strtab rodata and zeros

[Kris Van Hees]

---
 test/unittest/funcs/strlen/tst.rodata.d | 41 +++++++++++++++++++++++++
 test/unittest/funcs/strlen/tst.rodata.r |  4 +++
 test/unittest/funcs/strlen/tst.zeros.d  | 38 +++++++++++++++++++++++
 test/unittest/funcs/strlen/tst.zeros.r  |  3 ++
 4 files changed, 86 insertions(+)
 create mode 100644 test/unittest/funcs/strlen/tst.rodata.d
 create mode 100644 test/unittest/funcs/strlen/tst.rodata.r
 create mode 100644 test/unittest/funcs/strlen/tst.zeros.d
 create mode 100644 test/unittest/funcs/strlen/tst.zeros.r

diff --git a/test/unittest/funcs/strlen/tst.rodata.d b/test/unittest/funcs/strlen/tst.rodata.d
new file mode 100644
index 00000000..765a7717
--- /dev/null
+++ b/test/unittest/funcs/strlen/tst.rodata.d
@@ -0,0 +1,41 @@
+/*
+ * Oracle Linux DTrace.
+ * Copyright (c) 2026, Oracle and/or its affiliates. All rights reserved.
+ * Licensed under the Universal Permissive License v 1.0 as shown at
+ * http://oss.oracle.com/licenses/upl.
+ */
+
+/*
+ * ASSERTION: strlen() must not overwrite the IPv6 lookup table in the
+ *            rodata block of the strtab map.
+ *
+ * SECTION: Actions and Subroutines/strlen()
+ */
+/* @@nosort */
+
+#pragma D option quiet
+#pragma D option strsize=128
+
+BEGIN
+{
+	this->addr = (struct in6_addr *)alloca(sizeof(struct in6_addr));
+	this->addr->in6_u.u6_addr32[0] = 0;
+	this->addr->in6_u.u6_addr32[1] = 0;
+	this->addr->in6_u.u6_addr32[2] = 0;
+	this->addr->in6_u.u6_addr32[3] = 0;
+	printf("before: %s\n", inet_ntoa6(this->addr));
+
+	/*
+	 * Reach past any alignment padding and the reserved rodata byte into
+	 * the first lookup table entries, without reaching the zeros block.
+	 */
+	printf("length: %d\n", strlen(
+	    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"));
+	printf("after: %s\n", inet_ntoa6(this->addr));
+	exit(0);
+}
+
+ERROR
+{
+	exit(1);
+}
diff --git a/test/unittest/funcs/strlen/tst.rodata.r b/test/unittest/funcs/strlen/tst.rodata.r
new file mode 100644
index 00000000..0ad81e36
--- /dev/null
+++ b/test/unittest/funcs/strlen/tst.rodata.r
@@ -0,0 +1,4 @@
+before: ::
+length: 64
+after: ::
+
diff --git a/test/unittest/funcs/strlen/tst.zeros.d b/test/unittest/funcs/strlen/tst.zeros.d
new file mode 100644
index 00000000..c8928a1d
--- /dev/null
+++ b/test/unittest/funcs/strlen/tst.zeros.d
@@ -0,0 +1,38 @@
+/*
+ * Oracle Linux DTrace.
+ * Copyright (c) 2026, Oracle and/or its affiliates. All rights reserved.
+ * Licensed under the Universal Permissive License v 1.0 as shown at
+ * http://oss.oracle.com/licenses/upl.
+ */
+
+/*
+ * ASSERTION: strlen() must not overwrite the zeros block used to initialize
+ *            aggregations in the strtab map.
+ *
+ * SECTION: Actions and Subroutines/strlen()
+ */
+/* @@nosort */
+
+#pragma D option quiet
+#pragma D option strsize=128
+
+BEGIN
+{
+	/*
+	 * With no IPv6 lookup table, rodata contains only its reserved byte.
+	 * This string reaches past it and all padding into the zeros block.
+	 */
+	printf("length: %d\n", strlen(
+	    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"));
+
+	/* A new aggregation copies its initial value from the zeros block. */
+	@total = sum(1);
+	printa("total: %@d\n", @total);
+	clear(@total);
+	exit(0);
+}
+
+ERROR
+{
+	exit(1);
+}
diff --git a/test/unittest/funcs/strlen/tst.zeros.r b/test/unittest/funcs/strlen/tst.zeros.r
new file mode 100644
index 00000000..d8929b1a
--- /dev/null
+++ b/test/unittest/funcs/strlen/tst.zeros.r
@@ -0,0 +1,3 @@
+length: 64
+total: 1
+
-- 
2.52.0

Re: [PATCH 14/20] test: detect strlen corruption of strtab rodata and zeros

[Nick Alcock]

On 30 Oct 2026, Kris Van Hees verbalised:

> + * ASSERTION: strlen() must not overwrite the IPv6 lookup table in the
> + *            rodata block of the strtab map.

... I'm not surprised you didn't spot this. Who would expect a strlen to
overwrite anything? But now it works via dt_bpf_probe_read_str, it's
writing into (a temporary entry in) the strtab as a side-effect, with a
STRSZ max...

-- 
NULL && (void)

Re: [PATCH 14/20] test: detect strlen corruption of strtab rodata and zeros

[Nick Alcock]

On 6 Nov 2026, Nick Alcock told this:

> On 30 Oct 2026, Kris Van Hees verbalised:
>
>> + * ASSERTION: strlen() must not overwrite the IPv6 lookup table in the
>> + *            rodata block of the strtab map.
>
> ... I'm not surprised you didn't spot this. Who would expect a strlen to
> overwrite anything? But now it works via dt_bpf_probe_read_str, it's
> writing into (a temporary entry in) the strtab as a side-effect, with a
> STRSZ max...

Oh yeah, and

Reviewed-by: Nick Alcock <nix@esperi.org.uk>

-- 
NULL && (void)

Re: [PATCH 14/20] test: detect strlen corruption of strtab rodata and zeros

[Kris Van Hees]

On Fri, Nov 06, 2026 at 01:10:01PM +0000, Nick Alcock wrote:
> On 30 Oct 2026, Kris Van Hees verbalised:
> 
> > + * ASSERTION: strlen() must not overwrite the IPv6 lookup table in the
> > + *            rodata block of the strtab map.
> 
> ... I'm not surprised you didn't spot this. Who would expect a strlen to
> overwrite anything? But now it works via dt_bpf_probe_read_str, it's
> writing into (a temporary entry in) the strtab as a side-effect, with a
> STRSZ max...

So, R-b?