bpf_probe_read*str() may store junk after NUL terminator

["Daniel Xu" <dxu@xxxxxxxxx>]

Hi,

I recently received a bpftrace bug report [0] that identical strings
were being stored as separate entries in maps. I dug into the issue and
it turns out that bpf_probe_read*str() may store junk after the NUL
terminator due to how do_strncpy_from_user() does long-sized copies.

Here is the code in question from lib/strncpy_from_user.c:

       *(unsigned long *)(dst+res) = c;
       if (has_zero(c, &data, &constants)) {
               data = prep_zero_mask(c, data, &constants);
               data = create_zero_mask(data);
               return res + find_zero(data);
       }

This behavior is likely to cause subtle issues in bpf programs so a
kernel fix may be necessary.

Here is a quick reproducer:

str_trailing_bytes.c:

    #include <stdlib.h>
    #include <string.h>
    #include <unistd.h>

    const char s[] = "mestring";

    __attribute__((noinline)) void function1(char *first __attribute__((unused)),
					     char *second __attribute__((unused)))
    {
    }

    int main(int argc __attribute__((unused)), char **argv __attribute__((unused)))
    {
      char *first = malloc(64 * sizeof(char));
      char *second = malloc(64 * sizeof(char));

      // Make sure bytes after the first string are 0s
      memset(first, 0, 64 * sizeof(char));
      memcpy(first, s, sizeof(s));

      // Make sure bytes after second string are 1s
      memset(second, 1, 64 * sizeof(char));
      memcpy(second, s, sizeof(s));

      function1(first, second);

      free(first);
      free(second);
      return 0;
    }


# bpftrace -e \
  'uprobe:./str_trailing_bytes:function1 { @[str(arg0)] = count(); @[str(arg1)] = count(); exit() }' \ 
  -c ./str_trailing_bytes
Attaching 1 probe...


@[mestring]: 1
@[mestring]: 1


Thanks,
Daniel


[0]: https://github.com/iovisor/bpftrace/pull/1586/