From: Yonghong Song <yonghong.song@linux.dev>
To: Paul Chaignon <paul.chaignon@gmail.com>, bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
Florent Revest <revest@chromium.org>
Subject: Re: [PATCH bpf 1/2] bpf: Reject %p% format string in bprintf-like helpers
Date: Tue, 1 Jul 2025 08:56:56 -0700 [thread overview]
Message-ID: <e77c3c0c-b215-4bb4-87b4-1a2e5c346632@linux.dev> (raw)
In-Reply-To: <9d7c0974af8ab9b99723bd3f72d4bea8972d7cb5.1750953849.git.paul.chaignon@gmail.com>
On 6/26/25 9:06 AM, Paul Chaignon wrote:
> static const char fmt[] = "%p%";
> bpf_trace_printk(fmt, sizeof(fmt));
>
> The above BPF program isn't rejected and causes a kernel warning at
> runtime:
>
> Please remove unsupported %\x00 in format string
> WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0
>
> This happens because bpf_bprintf_prepare skips over the second %,
> detected as punctuation, while processing %p. This patch fixes it by
> not skipping over punctuation. %\x00 is then processed in the next
> iteration and rejected.
>
> Reported-by: syzbot+e2c932aec5c8a6e1d31c@syzkaller.appspotmail.com
> Fixes: 48cac3f4a96d ("bpf: Implement formatted output helpers with bstr_printf")
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
prev parent reply other threads:[~2025-07-01 15:57 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-26 16:06 [PATCH bpf 1/2] bpf: Reject %p% format string in bprintf-like helpers Paul Chaignon
2025-06-26 16:07 ` [PATCH bpf 2/2] selftests/bpf: Add negative test cases for snprintf Paul Chaignon
2025-07-01 16:03 ` Yonghong Song
2025-07-01 15:56 ` Yonghong Song [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e77c3c0c-b215-4bb4-87b4-1a2e5c346632@linux.dev \
--to=yonghong.song@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=paul.chaignon@gmail.com \
--cc=revest@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox