Forwarded: [PATCH] bpf: Fix double offset in check_reg_const_str()

[syzbot <syzbot+2c29addf92581b410079@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] bpf: Fix double offset in check_reg_const_str()
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git master

map_direct_value_addr() returns the address already offset by map_off,
but check_reg_const_str() adds map_off again when calling strnchr().
This causes the null-termination check to read from the wrong address,
potentially past the end of the map value buffer.

This triggers a KASAN slab-out-of-bounds in strnchr() when a BPF program
passes a PTR_TO_MAP_VALUE to a helper expecting ARG_PTR_TO_CONST_STR,
as the verifier fails to properly validate the string is null-terminated
within bounds.

Remove the redundant offset addition since map_addr already points to
the correct location.

Reported-by: syzbot+2c29addf92581b410079@syzkaller.appspotmail.com
Fixes: 0b51940729150 ("bpf: Factor out helper check_reg_const_str()")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 kernel/bpf/verifier.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index f0ca69f888fa..b1cb501fb577 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9638,7 +9638,7 @@ static int check_reg_const_str(struct bpf_verifier_env *env,
 	}
 
 	str_ptr = (char *)(long)(map_addr);
-	if (!strnchr(str_ptr + map_off, map->value_size - map_off, 0)) {
+	if (!strnchr(str_ptr, map->value_size - map_off, 0)) {
 		verbose(env, "string is not zero-terminated\n");
 		return -EINVAL;
 	}
-- 
2.43.0