* Re: [PATCH bpf-next v4 1/2] bpftool: Fix gen object segfault
2024-12-06 2:01 ` [PATCH bpf-next v4 1/2] bpftool: Fix gen object segfault Rong Tao
@ 2024-12-06 2:13 ` Alexei Starovoitov
2024-12-11 9:48 ` kernel test robot
1 sibling, 0 replies; 4+ messages in thread
From: Alexei Starovoitov @ 2024-12-06 2:13 UTC (permalink / raw)
To: Rong Tao
Cc: Andrii Nakryiko, Quentin Monnet, Alexei Starovoitov,
Daniel Borkmann, Andrii Nakryiko, rongtao, Martin KaFai Lau,
Eduard Zingerman, Song Liu, Yonghong Song, John Fastabend,
KP Singh, Stanislav Fomichev, Hao Luo, Jiri Olsa,
open list:BPF [TOOLING] (bpftool),
open list
On Thu, Dec 5, 2024 at 6:01 PM Rong Tao <rtoax@foxmail.com> wrote:
>
> From: Rong Tao <rongtao@cestc.cn>
>
> If the input file and output file are the same, the input file is cleared
> due to opening, resulting in a NULL pointer access by libbpf.
>
> $ bpftool gen object prog.o prog.o
> libbpf: failed to get ELF header for prog.o: invalid `Elf' handle
> Segmentation fault
>
> (gdb) bt
> #0 0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
> #1 bpf_linker__add_file (linker=0x4feda0, filename=<optimized out>, opts=<optimized out>) at linker.c:453
> #2 0x000000000040c235 in do_object ()
> #3 0x00000000004021d7 in main ()
> (gdb) frame 0
> #0 0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
> 1296 Elf64_Sym *sym = symtab->data->d_buf;
>
> Signed-off-by: Rong Tao <rongtao@cestc.cn>
> ---
> tools/bpf/bpftool/gen.c | 13 +++++++++++++
> 1 file changed, 13 insertions(+)
>
> diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
> index 5a4d3240689e..e5e3e8705cc7 100644
> --- a/tools/bpf/bpftool/gen.c
> +++ b/tools/bpf/bpftool/gen.c
> @@ -1879,6 +1879,8 @@ static int do_object(int argc, char **argv)
> struct bpf_linker *linker;
> const char *output_file, *file;
> int err = 0;
> + int argc_cpy;
> + char **argv_cpy;
>
> if (!REQ_ARGS(2)) {
> usage();
> @@ -1887,6 +1889,17 @@ static int do_object(int argc, char **argv)
>
> output_file = GET_ARG();
>
> + argc_cpy = argc;
> + argv_cpy = argv;
> +
> + /* Ensure we don't overwrite any input file */
> + while (argc_cpy--) {
> + if (!strcmp(output_file, *argv_cpy++)) {
> + p_err("Input and output files cannot be the same");
> + goto out;
This is completely broken. Just because the names are different
doesn't mean that they don't point to the same file.
Fix the root cause of segfault instead.
pw-bot: cr
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH bpf-next v4 1/2] bpftool: Fix gen object segfault
2024-12-06 2:01 ` [PATCH bpf-next v4 1/2] bpftool: Fix gen object segfault Rong Tao
2024-12-06 2:13 ` Alexei Starovoitov
@ 2024-12-11 9:48 ` kernel test robot
1 sibling, 0 replies; 4+ messages in thread
From: kernel test robot @ 2024-12-11 9:48 UTC (permalink / raw)
To: Rong Tao, andrii.nakryiko, qmo, ast, daniel, andrii, rongtao
Cc: oe-kbuild-all, Martin KaFai Lau, Eduard Zingerman, Song Liu,
Yonghong Song, John Fastabend, KP Singh, Stanislav Fomichev,
Hao Luo, Jiri Olsa, (open list:BPF (bpftool)),
linux-kernel
Hi Rong,
kernel test robot noticed the following build warnings:
[auto build test WARNING on bpf-next/master]
url: https://github.com/intel-lab-lkp/linux/commits/Rong-Tao/libbpf-linker-Avoid-using-object-file-as-both-input-and-output/20241206-100435
base: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
patch link: https://lore.kernel.org/r/tencent_B497E42A7CAF94A35B88EB060E42A2593408%40qq.com
patch subject: [PATCH bpf-next v4 1/2] bpftool: Fix gen object segfault
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241211/202412111714.9jJxt9x6-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202412111714.9jJxt9x6-lkp@intel.com/
Note: it may well be a FALSE warning. FWIW you are at least aware of it now.
http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings
All warnings (new ones prefixed by >>):
PERF_VERSION = 6.13.rc1.g228582f448e8
gen.c: In function 'do_object':
>> gen.c:1927:9: warning: 'linker' may be used uninitialized [-Wmaybe-uninitialized]
1927 | bpf_linker__free(linker);
| ^~~~~~~~~~~~~~~~~~~~~~~~
gen.c:1879:28: note: 'linker' was declared here
1879 | struct bpf_linker *linker;
| ^~~~~~
--
gen.c: In function 'do_object':
>> gen.c:1927:9: warning: 'linker' may be used uninitialized [-Wmaybe-uninitialized]
1927 | bpf_linker__free(linker);
| ^~~~~~~~~~~~~~~~~~~~~~~~
gen.c:1879:28: note: 'linker' was declared here
1879 | struct bpf_linker *linker;
| ^~~~~~
gen.c: In function 'do_object':
>> gen.c:1927:9: warning: 'linker' may be used uninitialized [-Wmaybe-uninitialized]
1927 | bpf_linker__free(linker);
| ^~~~~~~~~~~~~~~~~~~~~~~~
gen.c:1879:28: note: 'linker' was declared here
1879 | struct bpf_linker *linker;
| ^~~~~~
gen.c: In function 'do_object':
>> gen.c:1927:9: warning: 'linker' may be used uninitialized [-Wmaybe-uninitialized]
1927 | bpf_linker__free(linker);
| ^~~~~~~~~~~~~~~~~~~~~~~~
gen.c:1879:28: note: 'linker' was declared here
1879 | struct bpf_linker *linker;
| ^~~~~~
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread