[PATCH bpf-next v4 1/2] bpftool: Fix gen object segfault

[PATCH bpf-next v4 1/2] bpftool: Fix gen object segfault

[Rong Tao]

From: Rong Tao <rongtao@cestc.cn>

If the input file and output file are the same, the input file is cleared
due to opening, resulting in a NULL pointer access by libbpf.

    $ bpftool gen object prog.o prog.o
    libbpf: failed to get ELF header for prog.o: invalid `Elf' handle
    Segmentation fault

    (gdb) bt
    #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
    #1  bpf_linker__add_file (linker=0x4feda0, filename=<optimized out>, opts=<optimized out>) at linker.c:453
    #2  0x000000000040c235 in do_object ()
    #3  0x00000000004021d7 in main ()
    (gdb) frame 0
    #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
    1296		Elf64_Sym *sym = symtab->data->d_buf;

Signed-off-by: Rong Tao <rongtao@cestc.cn>
---
 tools/bpf/bpftool/gen.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
index 5a4d3240689e..e5e3e8705cc7 100644
--- a/tools/bpf/bpftool/gen.c
+++ b/tools/bpf/bpftool/gen.c
@@ -1879,6 +1879,8 @@ static int do_object(int argc, char **argv)
 	struct bpf_linker *linker;
 	const char *output_file, *file;
 	int err = 0;
+	int argc_cpy;
+	char **argv_cpy;
 
 	if (!REQ_ARGS(2)) {
 		usage();
@@ -1887,6 +1889,17 @@ static int do_object(int argc, char **argv)
 
 	output_file = GET_ARG();
 
+	argc_cpy = argc;
+	argv_cpy = argv;
+
+	/* Ensure we don't overwrite any input file */
+	while (argc_cpy--) {
+		if (!strcmp(output_file, *argv_cpy++)) {
+			p_err("Input and output files cannot be the same");
+			goto out;
+		}
+	}
+
 	linker = bpf_linker__new(output_file, NULL);
 	if (!linker) {
 		p_err("failed to create BPF linker instance");
-- 
2.47.1

[PATCH bpf-next v4 2/2] libbpf: linker: Avoid using object file as both input and output

[Rong Tao]

From: Rong Tao <rongtao@cestc.cn>

When the target file is used as input and output at the same time, the
input file will read a null value, resulting in a segmentation fault.

    $ bpftool gen object prog.o prog.o
    libbpf: failed to get ELF header for prog.o: invalid `Elf' handle
    Segmentation fault

    (gdb) bt
    #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
    #1  bpf_linker__add_file (linker=0x4feda0, filename=<optimized out>, opts=<optimized out>) at linker.c:453
    #2  0x000000000040c235 in do_object ()
    #3  0x00000000004021d7 in main ()
    (gdb) frame 0
    #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
    1296                Elf64_Sym *sym = symtab->data->d_buf;

Signed-off-by: Rong Tao <rongtao@cestc.cn>
---
 tools/lib/bpf/linker.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
index cf71d149fe26..0b117cc5b6e4 100644
--- a/tools/lib/bpf/linker.c
+++ b/tools/lib/bpf/linker.c
@@ -448,6 +448,11 @@ int bpf_linker__add_file(struct bpf_linker *linker, const char *filename,
 	if (!linker->elf)
 		return libbpf_err(-EINVAL);
 
+	if (!strcmp(filename, linker->filename)) {
+		pr_warn_elf("Input and output files cannot be the same");
+		return libbpf_err(-EINVAL);
+	}
+
 	err = err ?: linker_load_obj_file(linker, filename, opts, &obj);
 	err = err ?: linker_append_sec_data(linker, &obj);
 	err = err ?: linker_append_elf_syms(linker, &obj);
-- 
2.47.1

Re: [PATCH bpf-next v4 1/2] bpftool: Fix gen object segfault

[Alexei Starovoitov]

On Thu, Dec 5, 2024 at 6:01 PM Rong Tao <rtoax@foxmail.com> wrote:
>
> From: Rong Tao <rongtao@cestc.cn>
>
> If the input file and output file are the same, the input file is cleared
> due to opening, resulting in a NULL pointer access by libbpf.
>
>     $ bpftool gen object prog.o prog.o
>     libbpf: failed to get ELF header for prog.o: invalid `Elf' handle
>     Segmentation fault
>
>     (gdb) bt
>     #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
>     #1  bpf_linker__add_file (linker=0x4feda0, filename=<optimized out>, opts=<optimized out>) at linker.c:453
>     #2  0x000000000040c235 in do_object ()
>     #3  0x00000000004021d7 in main ()
>     (gdb) frame 0
>     #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
>     1296                Elf64_Sym *sym = symtab->data->d_buf;
>
> Signed-off-by: Rong Tao <rongtao@cestc.cn>
> ---
>  tools/bpf/bpftool/gen.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
>
> diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
> index 5a4d3240689e..e5e3e8705cc7 100644
> --- a/tools/bpf/bpftool/gen.c
> +++ b/tools/bpf/bpftool/gen.c
> @@ -1879,6 +1879,8 @@ static int do_object(int argc, char **argv)
>         struct bpf_linker *linker;
>         const char *output_file, *file;
>         int err = 0;
> +       int argc_cpy;
> +       char **argv_cpy;
>
>         if (!REQ_ARGS(2)) {
>                 usage();
> @@ -1887,6 +1889,17 @@ static int do_object(int argc, char **argv)
>
>         output_file = GET_ARG();
>
> +       argc_cpy = argc;
> +       argv_cpy = argv;
> +
> +       /* Ensure we don't overwrite any input file */
> +       while (argc_cpy--) {
> +               if (!strcmp(output_file, *argv_cpy++)) {
> +                       p_err("Input and output files cannot be the same");
> +                       goto out;

This is completely broken. Just because the names are different
doesn't mean that they don't point to the same file.

Fix the root cause of segfault instead.

pw-bot: cr

Re: [PATCH bpf-next v4 1/2] bpftool: Fix gen object segfault

[kernel test robot]

Hi Rong,

kernel test robot noticed the following build warnings:

[auto build test WARNING on bpf-next/master]

url:    https://github.com/intel-lab-lkp/linux/commits/Rong-Tao/libbpf-linker-Avoid-using-object-file-as-both-input-and-output/20241206-100435
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
patch link:    https://lore.kernel.org/r/tencent_B497E42A7CAF94A35B88EB060E42A2593408%40qq.com
patch subject: [PATCH bpf-next v4 1/2] bpftool: Fix gen object segfault
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241211/202412111714.9jJxt9x6-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202412111714.9jJxt9x6-lkp@intel.com/

Note: it may well be a FALSE warning. FWIW you are at least aware of it now.
http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings

All warnings (new ones prefixed by >>):

     PERF_VERSION = 6.13.rc1.g228582f448e8
   gen.c: In function 'do_object':
>> gen.c:1927:9: warning: 'linker' may be used uninitialized [-Wmaybe-uninitialized]
    1927 |         bpf_linker__free(linker);
         |         ^~~~~~~~~~~~~~~~~~~~~~~~
   gen.c:1879:28: note: 'linker' was declared here
    1879 |         struct bpf_linker *linker;
         |                            ^~~~~~
--
   gen.c: In function 'do_object':
>> gen.c:1927:9: warning: 'linker' may be used uninitialized [-Wmaybe-uninitialized]
    1927 |         bpf_linker__free(linker);
         |         ^~~~~~~~~~~~~~~~~~~~~~~~
   gen.c:1879:28: note: 'linker' was declared here
    1879 |         struct bpf_linker *linker;
         |                            ^~~~~~
   gen.c: In function 'do_object':
>> gen.c:1927:9: warning: 'linker' may be used uninitialized [-Wmaybe-uninitialized]
    1927 |         bpf_linker__free(linker);
         |         ^~~~~~~~~~~~~~~~~~~~~~~~
   gen.c:1879:28: note: 'linker' was declared here
    1879 |         struct bpf_linker *linker;
         |                            ^~~~~~
   gen.c: In function 'do_object':
>> gen.c:1927:9: warning: 'linker' may be used uninitialized [-Wmaybe-uninitialized]
    1927 |         bpf_linker__free(linker);
         |         ^~~~~~~~~~~~~~~~~~~~~~~~
   gen.c:1879:28: note: 'linker' was declared here
    1879 |         struct bpf_linker *linker;
         |                            ^~~~~~

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki