* [PATCH bpf-next v2] bpftool: Fix gen object segfault
@ 2024-12-05 11:10 Rong Tao
2024-12-05 11:20 ` Quentin Monnet
0 siblings, 1 reply; 3+ messages in thread
From: Rong Tao @ 2024-12-05 11:10 UTC (permalink / raw)
To: qmo, ast, daniel, rongtao
Cc: Andrii Nakryiko, Martin KaFai Lau, Eduard Zingerman, Song Liu,
Yonghong Song, John Fastabend, KP Singh, Stanislav Fomichev,
Hao Luo, Jiri Olsa, open list:BPF [TOOLING] (bpftool), open list
From: Rong Tao <rongtao@cestc.cn>
If the input file and output file are the same, the input file is cleared
due to opening, resulting in a NULL pointer access by libbpf.
$ bpftool gen object prog.o prog.o
libbpf: failed to get ELF header for prog.o: invalid `Elf' handle
Segmentation fault
(gdb) bt
#0 0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
#1 bpf_linker__add_file (linker=0x4feda0, filename=<optimized out>, opts=<optimized out>) at linker.c:453
#2 0x000000000040c235 in do_object ()
#3 0x00000000004021d7 in main ()
(gdb) frame 0
#0 0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
1296 Elf64_Sym *sym = symtab->data->d_buf;
Signed-off-by: Rong Tao <rongtao@cestc.cn>
---
v1: https://lore.kernel.org/lkml/tencent_410B8166C55CD2AB64BDEA8E92204619180A@qq.com/
---
tools/bpf/bpftool/gen.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
index 5a4d3240689e..506d205138db 100644
--- a/tools/bpf/bpftool/gen.c
+++ b/tools/bpf/bpftool/gen.c
@@ -1879,6 +1879,8 @@ static int do_object(int argc, char **argv)
struct bpf_linker *linker;
const char *output_file, *file;
int err = 0;
+ int argc_cpy = argc;
+ char **argv_cpy = argv;
if (!REQ_ARGS(2)) {
usage();
@@ -1887,6 +1889,14 @@ static int do_object(int argc, char **argv)
output_file = GET_ARG();
+ /* Ensure we don't overwrite any input file */
+ while (argc_cpy--) {
+ if (!strcmp(output_file, *argv_cpy++)) {
+ p_err("Input and output files cannot be the same");
+ goto out;
+ }
+ }
+
linker = bpf_linker__new(output_file, NULL);
if (!linker) {
p_err("failed to create BPF linker instance");
--
2.47.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH bpf-next v2] bpftool: Fix gen object segfault
2024-12-05 11:10 [PATCH bpf-next v2] bpftool: Fix gen object segfault Rong Tao
@ 2024-12-05 11:20 ` Quentin Monnet
2024-12-05 12:02 ` Rong Tao
0 siblings, 1 reply; 3+ messages in thread
From: Quentin Monnet @ 2024-12-05 11:20 UTC (permalink / raw)
To: Rong Tao, ast, daniel, rongtao
Cc: Andrii Nakryiko, Martin KaFai Lau, Eduard Zingerman, Song Liu,
Yonghong Song, John Fastabend, KP Singh, Stanislav Fomichev,
Hao Luo, Jiri Olsa, open list:BPF [TOOLING] (bpftool), open list
On 05/12/2024 11:10, Rong Tao wrote:
> From: Rong Tao <rongtao@cestc.cn>
>
> If the input file and output file are the same, the input file is cleared
> due to opening, resulting in a NULL pointer access by libbpf.
>
> $ bpftool gen object prog.o prog.o
> libbpf: failed to get ELF header for prog.o: invalid `Elf' handle
> Segmentation fault
>
> (gdb) bt
> #0 0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
> #1 bpf_linker__add_file (linker=0x4feda0, filename=<optimized out>, opts=<optimized out>) at linker.c:453
> #2 0x000000000040c235 in do_object ()
> #3 0x00000000004021d7 in main ()
> (gdb) frame 0
> #0 0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
> 1296 Elf64_Sym *sym = symtab->data->d_buf;
>
> Signed-off-by: Rong Tao <rongtao@cestc.cn>
> ---
> v1: https://lore.kernel.org/lkml/tencent_410B8166C55CD2AB64BDEA8E92204619180A@qq.com/
> ---
> tools/bpf/bpftool/gen.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
> index 5a4d3240689e..506d205138db 100644
> --- a/tools/bpf/bpftool/gen.c
> +++ b/tools/bpf/bpftool/gen.c
> @@ -1879,6 +1879,8 @@ static int do_object(int argc, char **argv)
> struct bpf_linker *linker;
> const char *output_file, *file;
> int err = 0;
> + int argc_cpy = argc;
> + char **argv_cpy = argv;
Oops sorry, argc_cpy and argv_cpy need to be initialised _after_ the
call to GET_ARG() below, otherwise we always start comparing output_file
with itself. Please test this code on your side, too :)
pw-bot: cr
>
> if (!REQ_ARGS(2)) {
> usage();
> @@ -1887,6 +1889,14 @@ static int do_object(int argc, char **argv)
>
> output_file = GET_ARG();
>
> + /* Ensure we don't overwrite any input file */
> + while (argc_cpy--) {
> + if (!strcmp(output_file, *argv_cpy++)) {
> + p_err("Input and output files cannot be the same");
> + goto out;
> + }
> + }
> +
> linker = bpf_linker__new(output_file, NULL);
> if (!linker) {
> p_err("failed to create BPF linker instance");
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH bpf-next v2] bpftool: Fix gen object segfault
2024-12-05 11:20 ` Quentin Monnet
@ 2024-12-05 12:02 ` Rong Tao
0 siblings, 0 replies; 3+ messages in thread
From: Rong Tao @ 2024-12-05 12:02 UTC (permalink / raw)
To: Quentin Monnet, ast, daniel, rongtao
Cc: Andrii Nakryiko, Martin KaFai Lau, Eduard Zingerman, Song Liu,
Yonghong Song, John Fastabend, KP Singh, Stanislav Fomichev,
Hao Luo, Jiri Olsa, open list:BPF [TOOLING] (bpftool), open list
On 12/5/24 19:20, Quentin Monnet wrote:
> On 05/12/2024 11:10, Rong Tao wrote:
>> From: Rong Tao <rongtao@cestc.cn>
>>
>> If the input file and output file are the same, the input file is cleared
>> due to opening, resulting in a NULL pointer access by libbpf.
>>
>> $ bpftool gen object prog.o prog.o
>> libbpf: failed to get ELF header for prog.o: invalid `Elf' handle
>> Segmentation fault
>>
>> (gdb) bt
>> #0 0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
>> #1 bpf_linker__add_file (linker=0x4feda0, filename=<optimized out>, opts=<optimized out>) at linker.c:453
>> #2 0x000000000040c235 in do_object ()
>> #3 0x00000000004021d7 in main ()
>> (gdb) frame 0
>> #0 0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
>> 1296 Elf64_Sym *sym = symtab->data->d_buf;
>>
>> Signed-off-by: Rong Tao <rongtao@cestc.cn>
>> ---
>> v1: https://lore.kernel.org/lkml/tencent_410B8166C55CD2AB64BDEA8E92204619180A@qq.com/
>> ---
>> tools/bpf/bpftool/gen.c | 10 ++++++++++
>> 1 file changed, 10 insertions(+)
>>
>> diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
>> index 5a4d3240689e..506d205138db 100644
>> --- a/tools/bpf/bpftool/gen.c
>> +++ b/tools/bpf/bpftool/gen.c
>> @@ -1879,6 +1879,8 @@ static int do_object(int argc, char **argv)
>> struct bpf_linker *linker;
>> const char *output_file, *file;
>> int err = 0;
>> + int argc_cpy = argc;
>> + char **argv_cpy = argv;
>
> Oops sorry, argc_cpy and argv_cpy need to be initialised _after_ the
> call to GET_ARG() below, otherwise we always start comparing output_file
> with itself. Please test this code on your side, too :)
>
> pw-bot: cr
Sorry, i just test this patch in [1], and it's works, maybe the
compile-flags is differenet.
I'll fix this and submit v2 soon, thanks!!
[1] https://github.com/libbpf/bpftool
>
>>
>> if (!REQ_ARGS(2)) {
>> usage();
>> @@ -1887,6 +1889,14 @@ static int do_object(int argc, char **argv)
>>
>> output_file = GET_ARG();
>>
>> + /* Ensure we don't overwrite any input file */
>> + while (argc_cpy--) {
>> + if (!strcmp(output_file, *argv_cpy++)) {
>> + p_err("Input and output files cannot be the same");
>> + goto out;
>> + }
>> + }
>> +
>> linker = bpf_linker__new(output_file, NULL);
>> if (!linker) {
>> p_err("failed to create BPF linker instance");
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-12-05 12:02 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-12-05 11:10 [PATCH bpf-next v2] bpftool: Fix gen object segfault Rong Tao
2024-12-05 11:20 ` Quentin Monnet
2024-12-05 12:02 ` Rong Tao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox