diff mbox series

[bpf-next] selftests/bpf: trace_helpers.c: Fix segfault

Message ID tencent_0D62BF818D106C96C26594CAC76BF3281306@qq.com (mailing list archive)
State Changes Requested
Delegated to: BPF
Headers show
Series [bpf-next] selftests/bpf: trace_helpers.c: Fix segfault | expand

Checks

Context Check Description
netdev/tree_selection success Clearly marked for bpf-next
netdev/apply fail Patch does not apply to bpf-next
bpf/vmtest-bpf-next-PR success PR summary
bpf/vmtest-bpf-next-VM_Test-1 success Logs for ShellCheck
bpf/vmtest-bpf-next-VM_Test-2 success Logs for build for aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-3 success Logs for build for aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-5 success Logs for build for x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-6 success Logs for build for x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-7 success Logs for set-matrix
bpf/vmtest-bpf-next-VM_Test-4 success Logs for build for s390x with gcc
bpf/vmtest-bpf-next-VM_Test-8 success Logs for test_maps on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-11 success Logs for test_maps on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-12 success Logs for test_maps on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-18 success Logs for test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-21 success Logs for test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-22 success Logs for test_progs_no_alu32 on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-23 success Logs for test_progs_no_alu32_parallel on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-25 success Logs for test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-26 success Logs for test_progs_no_alu32_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-27 success Logs for test_progs_parallel on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-29 success Logs for test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-30 success Logs for test_progs_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-31 success Logs for test_verifier on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-34 success Logs for test_verifier on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-35 success Logs for test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-9 success Logs for test_maps on aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-13 success Logs for test_progs on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-14 success Logs for test_progs on aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-16 success Logs for test_progs on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-17 success Logs for test_progs on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-19 success Logs for test_progs_no_alu32 on aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-24 success Logs for test_progs_no_alu32_parallel on aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-28 success Logs for test_progs_parallel on aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-32 success Logs for test_verifier on aarch64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-15 success Logs for test_progs on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-20 success Logs for test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-33 success Logs for test_verifier on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-10 success Logs for test_maps on s390x with gcc

Commit Message

Rong Tao April 9, 2023, 8:15 a.m. UTC 
From: Rong Tao <rongtao@cestc.cn>

When the number of symbols is greater than MAX_SYMS (300000), the access
array struct ksym syms[MAX_SYMS] goes out of bounds, which will result in
a segfault.

Resolve this issue by judging the maximum number and exiting the loop, and
increasing the default size appropriately. (6.2.9 = 329839 below)

    $ cat /proc/kallsyms | wc -l
    329839

    GDB debugging:
    $ cd linux/samples/bpf
    $ sudo gdb ./sampleip
    ...
    (gdb) r
    ...
    Program received signal SIGSEGV, Segmentation fault.
    0x00007ffff7e2debf in malloc () from /lib64/libc.so.6
    Missing separate debuginfos, use: dnf debuginfo-install
    elfutils-libelf-0.189-1.fc37.x86_64 glibc-2.36-9.fc37.x86_64
    libzstd-1.5.4-1.fc37.x86_64 zlib-1.2.12-5.fc37.x86_64
    (gdb) bt
    #0  0x00007ffff7e2debf in malloc () from /lib64/libc.so.6
    #1  0x00007ffff7e33f8e in strdup () from /lib64/libc.so.6
    #2  0x0000000000403fb0 in load_kallsyms_refresh() from trace_helpers.c
    #3  0x00000000004038b2 in main ()

Signed-off-by: Rong Tao <rongtao@cestc.cn>
---
 tools/testing/selftests/bpf/trace_helpers.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Comments

Jiri Olsa April 10, 2023, 4:05 p.m. UTC | #1 
On Sun, Apr 09, 2023 at 04:15:25PM +0800, Rong Tao wrote:
> From: Rong Tao <rongtao@cestc.cn>
> 
> When the number of symbols is greater than MAX_SYMS (300000), the access
> array struct ksym syms[MAX_SYMS] goes out of bounds, which will result in
> a segfault.
> 
> Resolve this issue by judging the maximum number and exiting the loop, and
> increasing the default size appropriately. (6.2.9 = 329839 below)
> 
>     $ cat /proc/kallsyms | wc -l
>     329839
> 
>     GDB debugging:
>     $ cd linux/samples/bpf
>     $ sudo gdb ./sampleip
>     ...
>     (gdb) r
>     ...
>     Program received signal SIGSEGV, Segmentation fault.
>     0x00007ffff7e2debf in malloc () from /lib64/libc.so.6
>     Missing separate debuginfos, use: dnf debuginfo-install
>     elfutils-libelf-0.189-1.fc37.x86_64 glibc-2.36-9.fc37.x86_64
>     libzstd-1.5.4-1.fc37.x86_64 zlib-1.2.12-5.fc37.x86_64
>     (gdb) bt
>     #0  0x00007ffff7e2debf in malloc () from /lib64/libc.so.6
>     #1  0x00007ffff7e33f8e in strdup () from /lib64/libc.so.6
>     #2  0x0000000000403fb0 in load_kallsyms_refresh() from trace_helpers.c
>     #3  0x00000000004038b2 in main ()
> 
> Signed-off-by: Rong Tao <rongtao@cestc.cn>

I had to apply by hand, there was some fuzz:

  patching file tools/testing/selftests/bpf/trace_helpers.c
  Hunk #1 succeeded at 18 with fuzz 2 (offset 4 lines).
  Hunk #2 succeeded at 48 (offset 4 lines).

but other than that looks good

Acked-by: Jiri Olsa <jolsa@kernel.org>

jirka

> ---
>  tools/testing/selftests/bpf/trace_helpers.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c
> index 09a16a77bae4..a9d589c560d2 100644
> --- a/tools/testing/selftests/bpf/trace_helpers.c
> +++ b/tools/testing/selftests/bpf/trace_helpers.c
> @@ -14,7 +14,7 @@
>  
>  #define DEBUGFS "/sys/kernel/debug/tracing/"
>  
> -#define MAX_SYMS 300000
> +#define MAX_SYMS 400000
>  static struct ksym syms[MAX_SYMS];
>  static int sym_cnt;
>  
> @@ -44,7 +44,8 @@ int load_kallsyms_refresh(void)
>  			continue;
>  		syms[i].addr = (long) addr;
>  		syms[i].name = strdup(func);
> -		i++;
> +		if (++i >= MAX_SYMS)
> +			break;
>  	}
>  	fclose(f);
>  	sym_cnt = i;
> -- 
> 2.39.2
>
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c
index 09a16a77bae4..a9d589c560d2 100644
--- a/tools/testing/selftests/bpf/trace_helpers.c
+++ b/tools/testing/selftests/bpf/trace_helpers.c
@@ -14,7 +14,7 @@ 
 
 #define DEBUGFS "/sys/kernel/debug/tracing/"
 
-#define MAX_SYMS 300000
+#define MAX_SYMS 400000
 static struct ksym syms[MAX_SYMS];
 static int sym_cnt;
 
@@ -44,7 +44,8 @@  int load_kallsyms_refresh(void)
 			continue;
 		syms[i].addr = (long) addr;
 		syms[i].name = strdup(func);
-		i++;
+		if (++i >= MAX_SYMS)
+			break;
 	}
 	fclose(f);
 	sym_cnt = i;