BPF List
 help / color / mirror / Atom feed
From: Yonghong Song <yonghong.song@linux.dev>
To: Paul Chaignon <paul.chaignon@gmail.com>, bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
	Daniel Borkmann <daniel@iogearbox.net>,
	Andrii Nakryiko <andrii@kernel.org>,
	Florent Revest <revest@chromium.org>
Subject: Re: [PATCH bpf 1/2] bpf: Reject %p% format string in bprintf-like helpers
Date: Tue, 1 Jul 2025 08:56:56 -0700	[thread overview]
Message-ID: <e77c3c0c-b215-4bb4-87b4-1a2e5c346632@linux.dev> (raw)
In-Reply-To: <9d7c0974af8ab9b99723bd3f72d4bea8972d7cb5.1750953849.git.paul.chaignon@gmail.com>



On 6/26/25 9:06 AM, Paul Chaignon wrote:
>      static const char fmt[] = "%p%";
>      bpf_trace_printk(fmt, sizeof(fmt));
>
> The above BPF program isn't rejected and causes a kernel warning at
> runtime:
>
>      Please remove unsupported %\x00 in format string
>      WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0
>
> This happens because bpf_bprintf_prepare skips over the second %,
> detected as punctuation, while processing %p. This patch fixes it by
> not skipping over punctuation. %\x00 is then processed in the next
> iteration and rejected.
>
> Reported-by: syzbot+e2c932aec5c8a6e1d31c@syzkaller.appspotmail.com
> Fixes: 48cac3f4a96d ("bpf: Implement formatted output helpers with bstr_printf")
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>

Acked-by: Yonghong Song <yonghong.song@linux.dev>


      parent reply	other threads:[~2025-07-01 15:57 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-06-26 16:06 [PATCH bpf 1/2] bpf: Reject %p% format string in bprintf-like helpers Paul Chaignon
2025-06-26 16:07 ` [PATCH bpf 2/2] selftests/bpf: Add negative test cases for snprintf Paul Chaignon
2025-07-01 16:03   ` Yonghong Song
2025-07-01 15:56 ` Yonghong Song [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=e77c3c0c-b215-4bb4-87b4-1a2e5c346632@linux.dev \
    --to=yonghong.song@linux.dev \
    --cc=andrii@kernel.org \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=paul.chaignon@gmail.com \
    --cc=revest@chromium.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox