selftests/bpf: Prevent out-of-bounds stack access in test_bpffs

Buf can be not zero-terminated leading to strstr() to access data beyond
the intended buf[] array. Fix by forcing zero termination.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20211124002325.1737739-12-andrii@kernel.org

diff --git a/tools/testing/selftests/bpf/prog_tests/test_bpffs.c b/tools/testing/selftests/bpf/prog_tests/test_bpffs.c
index ada95bf..214d9f4 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/test_bpffs.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_bpffs.c
@@ -19,11 +19,13 @@ static int read_iter(char *file)
        fd = open(file, 0);
        if (fd < 0)
                return -1;
-       while ((len = read(fd, buf, sizeof(buf))) > 0)
+       while ((len = read(fd, buf, sizeof(buf))) > 0) {
+               buf[sizeof(buf) - 1] = '\0';
                if (strstr(buf, "iter")) {
                        close(fd);
                        return 0;
                }
+       }
        close(fd);
        return -1;
 }