selftests/bpf: Fix invalid use of strncat in test_sockmap

strncat()'s third argument is how many bytes will be added *in addition* to already existing bytes in destination. Plus extra zero byte will be added after that. So existing use in test_sockmap has many opportunities to overflow the string and cause memory corruptions. And in this case, GCC complains for a good reason. Fixes: 16962b2 ("bpf: sockmap, add selftests") Fixes: 73563aa ("selftests/bpf: test_sockmap, print additional test options") Fixes: 1ade9ab ("bpf: test_sockmap, add options for msg_pop_data() helper") Fixes: 463bac5 ("bpf, selftests: Add test for ktls with skb bpf ingress policy") Fixes: e9dd904 ("bpf: add tls support for testing in test_sockmap") Fixes: 753fb2e ("bpf: sockmap, add msg_peek tests to test_sockmap") Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20201203235440.2302137-2-andrii@kernel.org

Author: anakryiko

tools/testing/selftests/bpf/test_sockmap.c

@@ -1273,6 +1273,16 @@ static char *test_to_str(int test)
 return "unknown";
 }
 
+static void append_str(char *dst, const char *src, size_t dst_cap)
+{
+size_t avail = dst_cap - strlen(dst);
+
+if (avail <= 1) /* just zero byte could be written */
+return;
+
+strncat(dst, src, avail - 1); /* strncat() adds + 1 for zero byte */
+}
+
 #define OPTSTRING 60
 static void test_options(char *options)
 {
@@ -1281,42 +1291,42 @@ static void test_options(char *options)
 memset(options, 0, OPTSTRING);
 
 if (txmsg_pass)
-strncat(options, "pass,", OPTSTRING);
+append_str(options, "pass,", OPTSTRING);
 if (txmsg_redir)
-strncat(options, "redir,", OPTSTRING);
+append_str(options, "redir,", OPTSTRING);
 if (txmsg_drop)
-strncat(options, "drop,", OPTSTRING);
+append_str(options, "drop,", OPTSTRING);
 if (txmsg_apply) {
 snprintf(tstr, OPTSTRING, "apply %d,", txmsg_apply);
-strncat(options, tstr, OPTSTRING);
+append_str(options, tstr, OPTSTRING);
 }
 if (txmsg_cork) {
 snprintf(tstr, OPTSTRING, "cork %d,", txmsg_cork);
-strncat(options, tstr, OPTSTRING);
+append_str(options, tstr, OPTSTRING);
 }
 if (txmsg_start) {
 snprintf(tstr, OPTSTRING, "start %d,", txmsg_start);
-strncat(options, tstr, OPTSTRING);
+append_str(options, tstr, OPTSTRING);
 }
 if (txmsg_end) {
 snprintf(tstr, OPTSTRING, "end %d,", txmsg_end);
-strncat(options, tstr, OPTSTRING);
+append_str(options, tstr, OPTSTRING);
 }
 if (txmsg_start_pop) {
 snprintf(tstr, OPTSTRING, "pop (%d,%d),",
  txmsg_start_pop, txmsg_start_pop + txmsg_pop);
-strncat(options, tstr, OPTSTRING);
+append_str(options, tstr, OPTSTRING);
 }
 if (txmsg_ingress)
-strncat(options, "ingress,", OPTSTRING);
+append_str(options, "ingress,", OPTSTRING);
 if (txmsg_redir_skb)
-strncat(options, "redir_skb,", OPTSTRING);
+append_str(options, "redir_skb,", OPTSTRING);
 if (txmsg_ktls_skb)
-strncat(options, "ktls_skb,", OPTSTRING);
+append_str(options, "ktls_skb,", OPTSTRING);
 if (ktls)
-strncat(options, "ktls,", OPTSTRING);
+append_str(options, "ktls,", OPTSTRING);
 if (peek_flag)
-strncat(options, "peek,", OPTSTRING);
+append_str(options, "peek,", OPTSTRING);
 }
 
 static int __test_exec(int cgrp, int test, struct sockmap_options *opt)