Re: perf test 40 Basic BPF llvm compile dumps core (x86 and s390)

Re: perf test 40 Basic BPF llvm compile dumps core (x86 and s390)

[Arnaldo Carvalho de Melo]

Em Fri, May 28, 2021 at 12:48:56PM +0200, Thomas Richter escreveu:
> I noticed perf test 40.1 dumps core on 5.13.0rc2 and rc3:
> 
> [root@f34 perf]# ./perf test -F 40
> 40: LLVM search and compile                                         :
> 40.1: Basic BPF llvm compile                                        :
> libbpf: elf: skipping unrecognized data section(8) .eh_frame
> libbpf: elf: skipping relo section(9) .rel.eh_frame for section(8) .eh_frame
> Segmentation fault (core dumped)
> [root@f34 perf]#

> The root cause is a NULL pointer reference in function btf__get_nr_types()
> as can be seen with gdb:

This looks like a bug in libbpf:

static int bpf_object__collect_externs(struct bpf_object *obj)
{
        struct btf_type *sec, *kcfg_sec = NULL, *ksym_sec = NULL;
        const struct btf_type *t;
        struct extern_desc *ext;
        int i, n, off, dummy_var_btf_id;
        const char *ext_name, *sec_name;
        Elf_Scn *scn;
        GElf_Shdr sh;

        if (!obj->efile.symbols)
                return 0;

        scn = elf_sec_by_idx(obj, obj->efile.symbols_shndx);
        if (elf_sec_hdr(obj, scn, &sh))
                return -LIBBPF_ERRNO__FORMAT;

        dummy_var_btf_id = add_dummy_ksym_var(obj->btf);
        if (dummy_var_btf_id < 0)
                return dummy_var_btf_id;


obj->btf is NULL, so probably btf__find_by_name_kind() should check that
and return an error, Andrii?

- Arnaldo
 
> Breakpoint 1, 0x000000000065f4b1 in btf__get_nr_types
>      (btf=btf@entry=0x0) at btf.c:425
> 425		return btf->start_id + btf->nr_types - 1;
> 
> This is the same function and reason why test case 42.1 Basic BPF filtering
> fails and dumps core too.
> 
> The call chain is:
> (gdb) where
>  #0  0x000000000065f4b1 in btf__get_nr_types (btf=btf@entry=0x0) at btf.c:425
>  #1  btf__find_by_name_kind (btf=btf@entry=0x0,
> 		type_name=type_name@entry=0x928ab2 ".ksyms",
> 		kind=kind@entry=15) at btf.c:696
>  #2  0x00000000006527fe in add_dummy_ksym_var (btf=0x0) at libbpf.c:3219
>  #3  bpf_object__collect_externs (obj=0xd0ea20) at libbpf.c:3266
>  #4  __bpf_object__open (path=<optimized out>, path@entry=0x0,
> 		obj_buf=obj_buf@entry=0xd12fa0,
> 		obj_buf_sz=obj_buf_sz@entry=1520,
>     		opts=opts@entry=0x7fffffffdb30) at libbpf.c:7372
>  #5  0x0000000000655415 in __bpf_object__open (opts=0x7fffffffdb30,
> 		obj_buf_sz=1520, obj_buf=0xd12fa0, path=0x0) at libbpf.c:7337
>  #6  bpf_object__open_mem (opts=0x7fffffffdb30, obj_buf_sz=1520,
> 		obj_buf=0xd12fa0) at libbpf.c:7454
>  #7  bpf_object__open_mem (opts=0x7fffffffdb30, obj_buf_sz=1520,
> 		obj_buf=0xd12fa0) at libbpf.c:7448
>  #8  bpf_object__open_buffer (obj_buf=0xd12fa0, obj_buf_sz=1520,
> 		name=<optimized out>) at libbpf.c:7471
>  #9  0x00000000004c8c6e in test__bpf_parsing (obj_buf=0xd12fa0,
> 		obj_buf_sz=1520) at tests/llvm.c:16
>  #10 0x00000000004c8fe2 in test__llvm (test=0xac7d20 <generic_tests+2496>,
> 		subtest=0) at tests/llvm.c:142
> ...
> 
> I have no knowledge about BPF and why the core dump happens. Before
> I start digging into this has anybody some hints on where to look?
> 
> Thanks a lot.
> 
> -- 
> Thomas Richter, Dept 3303, IBM s390 Linux Development, Boeblingen, Germany
> --
> Vorsitzender des Aufsichtsrats: Gregor Pillen
> Geschäftsführung: Dirk Wittkopp
> Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294

-- 

- Arnaldo

Re: perf test 40 Basic BPF llvm compile dumps core (x86 and s390)

[Andrii Nakryiko]

On Fri, May 28, 2021 at 6:01 AM Arnaldo Carvalho de Melo
<arnaldo.melo@gmail.com> wrote:
>
> Em Fri, May 28, 2021 at 12:48:56PM +0200, Thomas Richter escreveu:
> > I noticed perf test 40.1 dumps core on 5.13.0rc2 and rc3:
> >
> > [root@f34 perf]# ./perf test -F 40
> > 40: LLVM search and compile                                         :
> > 40.1: Basic BPF llvm compile                                        :
> > libbpf: elf: skipping unrecognized data section(8) .eh_frame
> > libbpf: elf: skipping relo section(9) .rel.eh_frame for section(8) .eh_frame
> > Segmentation fault (core dumped)
> > [root@f34 perf]#
>
> > The root cause is a NULL pointer reference in function btf__get_nr_types()
> > as can be seen with gdb:
>
> This looks like a bug in libbpf:
>
> static int bpf_object__collect_externs(struct bpf_object *obj)
> {
>         struct btf_type *sec, *kcfg_sec = NULL, *ksym_sec = NULL;
>         const struct btf_type *t;
>         struct extern_desc *ext;
>         int i, n, off, dummy_var_btf_id;
>         const char *ext_name, *sec_name;
>         Elf_Scn *scn;
>         GElf_Shdr sh;
>
>         if (!obj->efile.symbols)
>                 return 0;
>
>         scn = elf_sec_by_idx(obj, obj->efile.symbols_shndx);
>         if (elf_sec_hdr(obj, scn, &sh))
>                 return -LIBBPF_ERRNO__FORMAT;
>
>         dummy_var_btf_id = add_dummy_ksym_var(obj->btf);
>         if (dummy_var_btf_id < 0)
>                 return dummy_var_btf_id;
>
>
> obj->btf is NULL, so probably btf__find_by_name_kind() should check that
> and return an error, Andrii?
>

This is already fixed in libbpf v0.4 ([0]). Can you please update
pahole's libbpf submodule sha?

  [0] https://github.com/libbpf/libbpf/commit/a58b8ca93e39285a2852ca3d60e698598bf7265b

> - Arnaldo
>
> > Breakpoint 1, 0x000000000065f4b1 in btf__get_nr_types
> >      (btf=btf@entry=0x0) at btf.c:425
> > 425           return btf->start_id + btf->nr_types - 1;
> >
> > This is the same function and reason why test case 42.1 Basic BPF filtering
> > fails and dumps core too.
> >
> > The call chain is:
> > (gdb) where
> >  #0  0x000000000065f4b1 in btf__get_nr_types (btf=btf@entry=0x0) at btf.c:425
> >  #1  btf__find_by_name_kind (btf=btf@entry=0x0,
> >               type_name=type_name@entry=0x928ab2 ".ksyms",
> >               kind=kind@entry=15) at btf.c:696
> >  #2  0x00000000006527fe in add_dummy_ksym_var (btf=0x0) at libbpf.c:3219
> >  #3  bpf_object__collect_externs (obj=0xd0ea20) at libbpf.c:3266
> >  #4  __bpf_object__open (path=<optimized out>, path@entry=0x0,
> >               obj_buf=obj_buf@entry=0xd12fa0,
> >               obj_buf_sz=obj_buf_sz@entry=1520,
> >               opts=opts@entry=0x7fffffffdb30) at libbpf.c:7372
> >  #5  0x0000000000655415 in __bpf_object__open (opts=0x7fffffffdb30,
> >               obj_buf_sz=1520, obj_buf=0xd12fa0, path=0x0) at libbpf.c:7337
> >  #6  bpf_object__open_mem (opts=0x7fffffffdb30, obj_buf_sz=1520,
> >               obj_buf=0xd12fa0) at libbpf.c:7454
> >  #7  bpf_object__open_mem (opts=0x7fffffffdb30, obj_buf_sz=1520,
> >               obj_buf=0xd12fa0) at libbpf.c:7448
> >  #8  bpf_object__open_buffer (obj_buf=0xd12fa0, obj_buf_sz=1520,
> >               name=<optimized out>) at libbpf.c:7471
> >  #9  0x00000000004c8c6e in test__bpf_parsing (obj_buf=0xd12fa0,
> >               obj_buf_sz=1520) at tests/llvm.c:16
> >  #10 0x00000000004c8fe2 in test__llvm (test=0xac7d20 <generic_tests+2496>,
> >               subtest=0) at tests/llvm.c:142
> > ...
> >
> > I have no knowledge about BPF and why the core dump happens. Before
> > I start digging into this has anybody some hints on where to look?
> >
> > Thanks a lot.
> >
> > --
> > Thomas Richter, Dept 3303, IBM s390 Linux Development, Boeblingen, Germany
> > --
> > Vorsitzender des Aufsichtsrats: Gregor Pillen
> > Geschäftsführung: Dirk Wittkopp
> > Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294
>
> --
>
> - Arnaldo