bpf: Reject %p% format string in bprintf-like helpers

JIRA: https://issues.redhat.com/browse/RHEL-110274

commit f824274
Author: Paul Chaignon <paul.chaignon@gmail.com>
Date:   Tue Jul 1 21:47:30 2025 +0200

    bpf: Reject %p% format string in bprintf-like helpers
    
    static const char fmt[] = "%p%";
        bpf_trace_printk(fmt, sizeof(fmt));
    
    The above BPF program isn't rejected and causes a kernel warning at
    runtime:
    
        Please remove unsupported %\x00 in format string
        WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0
    
    This happens because bpf_bprintf_prepare skips over the second %,
    detected as punctuation, while processing %p. This patch fixes it by
    not skipping over punctuation. %\x00 is then processed in the next
    iteration and rejected.
    
    Reported-by: syzbot+e2c932aec5c8a6e1d31c@syzkaller.appspotmail.com
    Fixes: 48cac3f ("bpf: Implement formatted output helpers with bstr_printf")
    Acked-by: Yonghong Song <yonghong.song@linux.dev>
    Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
    Link: https://lore.kernel.org/r/a0e06cc479faec9e802ae51ba5d66420523251ee.1751395489.git.paul.chaignon@gmail.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    

Signed-off-by: Viktor Malik <vmalik@redhat.com>

Author: viktormalik

kernel/bpf/helpers.c

@@ -882,18 +882,23 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args,
 		if (fmt[i] == 'p') {
 			sizeof_cur_arg = sizeof(long);
 
+			if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) ||
+			    ispunct(fmt[i + 1])) {
+				if (tmp_buf)
+					cur_arg = raw_args[num_spec];
+				goto nocopy_fmt;
+			}
+
 			if ((fmt[i + 1] == 'k' || fmt[i + 1] == 'u') &&
 			    fmt[i + 2] == 's') {
 				fmt_ptype = fmt[i + 1];
 				i += 2;
 				goto fmt_str;
 			}
 
-			if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) ||
-			    ispunct(fmt[i + 1]) || fmt[i + 1] == 'K' ||
+			if (fmt[i + 1] == 'K' ||
 			    fmt[i + 1] == 'x' || fmt[i + 1] == 's' ||
 			    fmt[i + 1] == 'S') {
-				/* just kernel pointers */
 				if (tmp_buf)
 					cur_arg = raw_args[num_spec];
 				i++;