Skip to contentSkip to conversation

selftests/x86/lam: Zero out buffer for readlink()

PATCH Superseded Binbin Wu 2 participants 5 messages Sep 27, 2023 – Oct 10, 2023

Subsystems (2)
x86 Kselftest

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

Binbin Wu

author
#0 lore raw

PATCH 1/1 selftests/x86/lam: Zero out buffer for readlink()

Zero out the buffer for readlink() since readlink() does not append a terminating null byte to the buffer.

Fixes 833c12ce0f430 ("selftests/x86/lam: Add inherit test cases for linear-address masking")
Signed-off-by Binbin Wu <[email protected]>
---
 tools/testing/selftests/x86/lam.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/x86/lam.c +1 -1
index eb0e46905bf9..9f06942a8e25 100644
@@ -680,7 +680,7 @@ static int handle_execve(struct testcases *test)
 		perror("Fork failed.");
 		ret = 1;
 	} else if (pid == 0) {
-		char path[PATH_MAX];
+		char path[PATH_MAX] = {0};
 
 		/* Set LAM mode in parent process */
 		if (set_lam(lam) != 0)

base-commit: ce9ecca0238b140b88f43859b211c9fdfd8e5b70

Signature · 1 line
2.25.1
#1 lore raw
Quoted 15 lines · Binbin Wu

Zero out the buffer for readlink() since readlink() does not append a terminating null byte to the buffer.

Fixes 833c12ce0f430 ("selftests/x86/lam: Add inherit test cases for linear-address masking")
Signed-off-by Binbin Wu <[email protected]>
---
 tools/testing/selftests/x86/lam.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/x86/lam.c +0 -0
index eb0e46905bf9..9f06942a8e25 100644

tools/testing/selftests/x86/lam.c static int handle_execve(struct testcases *test) · line 683

Quoted 5 lines
tools/testing/selftests/x86/lam.c +1 -1
@@ -680,7 +680,7 @@ static int handle_execve(struct testcases *test)
 		perror("Fork failed.");
 		ret = 1;
 	} else if (pid == 0) {
-		char path[PATH_MAX];
+		char path[PATH_MAX] = {0};

Shouldn't it be PATH_MAX+1 to handle the case when readlink(2) stores exactly PATH_MAX bytes into the buffer?

Quoted 8 lines
tools/testing/selftests/x86/lam.c +0 -0
 		/* Set LAM mode in parent process */
 		if (set_lam(lam) != 0)

base-commit: ce9ecca0238b140b88f43859b211c9fdfd8e5b70

Signature · 1 line
2.25.1
Signature · 1 line
  Kiryl Shutsemau / Kirill A. Shutemov
author
#2 lore raw
Quoted 11 lines · On 9/27/2023 7:02 PM, [email protected] wrote:
Quoted 10 lines · Binbin Wu

Zero out the buffer for readlink() since readlink() does not append a terminating null byte to the buffer.

Fixes 833c12ce0f430 ("selftests/x86/lam: Add inherit test cases for linear-address masking")
Signed-off-by Binbin Wu <[email protected]>
---
  tools/testing/selftests/x86/lam.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
Quoted 12 lines

tools/testing/selftests/x86/lam.c static int handle_execve(struct testcases *test) · line 683

Quoted 10 lines
tools/testing/selftests/x86/lam.c +1 -1
index eb0e46905bf9..9f06942a8e25 100644
@@ -680,7 +680,7 @@ static int handle_execve(struct testcases *test)
  		perror("Fork failed.");
  		ret = 1;
  	} else if (pid == 0) {
-		char path[PATH_MAX];
+		char path[PATH_MAX] = {0};

Shouldn't it be PATH_MAX+1 to handle the case when readlink(2) stores exactly PATH_MAX bytes into the buffer?

According to the definition of PATH_MAX in include/uapi/linux/limits.h #define PATH_MAX        4096    /* # chars in a path name including nul */

IIUC, Linux limits the path length to 4095 and PATH_MAX includes the terminating nul.

Quoted 9 lines
Quoted 9 lines
tools/testing/selftests/x86/lam.c +0 -0
  		/* Set LAM mode in parent process */
  		if (set_lam(lam) != 0)

base-commit: ce9ecca0238b140b88f43859b211c9fdfd8e5b70

Signature · 1 line
2.25.1
#3 lore raw
Quoted 26 lines · Binbin Wu
Quoted 11 lines · On 9/27/2023 7:02 PM, [email protected] wrote:
Quoted 10 lines · Binbin Wu

Zero out the buffer for readlink() since readlink() does not append a terminating null byte to the buffer.

Fixes 833c12ce0f430 ("selftests/x86/lam: Add inherit test cases for linear-address masking")
Signed-off-by Binbin Wu <[email protected]>
---
  tools/testing/selftests/x86/lam.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
Quoted 12 lines

tools/testing/selftests/x86/lam.c static int handle_execve(struct testcases *test) · line 683

Quoted 10 lines
tools/testing/selftests/x86/lam.c +1 -1
index eb0e46905bf9..9f06942a8e25 100644
@@ -680,7 +680,7 @@ static int handle_execve(struct testcases *test)
  		perror("Fork failed.");
  		ret = 1;
  	} else if (pid == 0) {
-		char path[PATH_MAX];
+		char path[PATH_MAX] = {0};

Shouldn't it be PATH_MAX+1 to handle the case when readlink(2) stores exactly PATH_MAX bytes into the buffer?

Quoted 5 lines

According to the definition of PATH_MAX in include/uapi/linux/limits.h #define PATH_MAX        4096    /* # chars in a path name including nul */

IIUC, Linux limits the path length to 4095 and PATH_MAX includes the terminating nul.

Consider the case when kernel bump PATH_MAX to 8192. The binary that compiled from lam.c against the older kernel headers will get compromised.

Increase the size of the buffer by one or pass PATH_MAX - 1 as buffer size to readlink(2).

Signature · 1 line
  Kiryl Shutsemau / Kirill A. Shutemov
author
#4 lore raw
Quoted 29 lines · On 10/10/2023 1:46 PM, [email protected] wrote:
Quoted 28 lines · Binbin Wu
Quoted 11 lines · On 9/27/2023 7:02 PM, [email protected] wrote:
Quoted 10 lines · Binbin Wu

Zero out the buffer for readlink() since readlink() does not append a terminating null byte to the buffer.

Fixes 833c12ce0f430 ("selftests/x86/lam: Add inherit test cases for linear-address masking")
Signed-off-by Binbin Wu <[email protected]>
---
   tools/testing/selftests/x86/lam.c | 2 +-
   1 file changed, 1 insertion(+), 1 deletion(-)
Quoted 12 lines

tools/testing/selftests/x86/lam.c static int handle_execve(struct testcases *test) · line 683

Quoted 10 lines
tools/testing/selftests/x86/lam.c +1 -1
index eb0e46905bf9..9f06942a8e25 100644
@@ -680,7 +680,7 @@ static int handle_execve(struct testcases *test)
   		perror("Fork failed.");
   		ret = 1;
   	} else if (pid == 0) {
-		char path[PATH_MAX];
+		char path[PATH_MAX] = {0};

Shouldn't it be PATH_MAX+1 to handle the case when readlink(2) stores exactly PATH_MAX bytes into the buffer?

According to the definition of PATH_MAX in include/uapi/linux/limits.h #define PATH_MAX        4096    /* # chars in a path name including nul */

Quoted 7 lines
Quoted 2 lines

IIUC, Linux limits the path length to 4095 and PATH_MAX includes the terminating nul.

Consider the case when kernel bump PATH_MAX to 8192. The binary that compiled from lam.c against the older kernel headers will get compromised.

Increase the size of the buffer by one or pass PATH_MAX - 1 as buffer size to readlink(2).

Make sense, thanks!
I will send a new version as following:

tools/testing/selftests/x86/lam.c +0 -0
index eb0e46905bf9..8f9b06d9ce03 100644
@@ -573,7 +573,7 @@ int do_uring(unsigned long lam)

        char path[PATH_MAX] = {0};

        /* get current process path */
-       if (readlink("/proc/self/exe", path, PATH_MAX) <= 0) +       if (readlink("/proc/self/exe", path, PATH_MAX - 1) <= 0) return 1;

        int file_fd = open(path, O_RDONLY);
@@ -680,14 +680,14 @@ static int handle_execve(struct testcases *test) perror("Fork failed.");
                ret = 1;
        } else if (pid == 0) {
-               char path[PATH_MAX];
+               char path[PATH_MAX] = {0};

                /* Set LAM mode in parent process */ if (set_lam(lam) != 0) return 1;

                /* Get current binary's path and the binary was run by execve */ -               if (readlink("/proc/self/exe", path, PATH_MAX) <= 0) +               if (readlink("/proc/self/exe", path, PATH_MAX - 1) <= 0) exit(-1);

                /* run binary to get LAM mode and return to parent process */

Quoted 1 line