On Thu, 31. Oct 17:17, Florent Revest wrote: > Acked-by: Florent Revest <revest@xxxxxxxxxxxx> > > On Tue, Oct 29, 2024 at 7:18 AM Yonghong Song <yonghong.song@xxxxxxxxx> wrote: > > On 10/28/24 12:53 PM, Ilya Shchipletsov wrote: > > > Fuzzing reports a warning in format_decode() > > > > > > Please remove unsupported %� in format string > > > WARNING: CPU: 0 PID: 5091 at lib/vsprintf.c:2680 format_decode+0x1193/0x1bb0 lib/vsprintf.c:2680 > > > Modules linked in: > > > CPU: 0 PID: 5091 Comm: syz-executor879 Not tainted 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0 > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 > > > RIP: 0010:format_decode+0x1193/0x1bb0 lib/vsprintf.c:2680 > > > Call Trace: > > > <TASK> > > > bstr_printf+0x137/0x1210 lib/vsprintf.c:3253 > > > ____bpf_trace_printk kernel/trace/bpf_trace.c:390 [inline] > > > bpf_trace_printk+0x1a1/0x230 kernel/trace/bpf_trace.c:375 > > > bpf_prog_21da1b68f62e1237+0x36/0x41 > > > bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] > > > __bpf_prog_run include/linux/filter.h:691 [inline] > > > bpf_prog_run include/linux/filter.h:698 [inline] > > > bpf_test_run+0x40b/0x910 net/bpf/test_run.c:425 > > > bpf_prog_test_run_skb+0xafa/0x13a0 net/bpf/test_run.c:1066 > > > bpf_prog_test_run+0x33c/0x3b0 kernel/bpf/syscall.c:4291 > > > __sys_bpf+0x48d/0x810 kernel/bpf/syscall.c:5705 > > > __do_sys_bpf kernel/bpf/syscall.c:5794 [inline] > > > __se_sys_bpf kernel/bpf/syscall.c:5792 [inline] > > > __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5792 > > > do_syscall_x64 arch/x86/entry/common.c:52 [inline] > > > do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > > > > > The problem occurs when trying to pass %p% at the end of format string, > > > which would result in skipping last % and passing invalid format string > > > down to format_decode() that would cause warning because of invalid > > > character after %. > > > > > > Fix issue by advancing pointer only if next char is format modifier. > > > If next char is null/space/punct, then just accept formatting as is, > > > without advancing the pointer. > > > > > > Found by Linux Verification Center (linuxtesting.org) with Syzkaller. > > > > > > Reported-by: syzbot+e2c932aec5c8a6e1d31c@xxxxxxxxxxxxxxxxxxxxxxxxx > > > Closes: https://syzkaller.appspot.com/bug?extid=e2c932aec5c8a6e1d31c > > > Fixes: 48cac3f4a96d ("bpf: Implement formatted output helpers with bstr_printf") > > > Co-developed-by: Nikita Marushkin <hfggklm@xxxxxxxxx> > > > Signed-off-by: Nikita Marushkin <hfggklm@xxxxxxxxx> > > > Signed-off-by: Ilya Shchipletsov <rabbelkin@xxxxxxx> > > > > Acked-by: Yonghong Song <yonghong.song@xxxxxxxxx> > > The patches of the series are marked as "Changes Requested" in Patchwork. They've been acked twice. And there've been no additional comment posted on mailing lists explaining the "Changes Required" status. Is there anything to improve in the series? Or it can be applied as is? -- Thanks, Fedor
