[v1] libbpf: Initialize st_ops->tname with strdup()

[PATCH] libbpf: Initialize st_ops->tname with strdup()

Posted by Soma Nakata 1 year, 5 months ago

`tname` is returned by `btf__name_by_offset()` as well as `var_name`,
and these addresses point to strings in the btf. Since their locations
may change while loading the bpf program, using `strdup()` ensures
`tname` is safely stored.

Signed-off-by: Soma Nakata <soma.nakata01@gmail.com>
---
 tools/lib/bpf/libbpf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index a3be6f8fac09..ece1f1af2cd4 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -1423,7 +1423,7 @@ static int init_struct_ops_maps(struct bpf_object *obj, const char *sec_name,
 		memcpy(st_ops->data,
 		       data->d_buf + vsi->offset,
 		       type->size);
-		st_ops->tname = tname;
+		st_ops->tname = strdup(tname);
 		st_ops->type = type;
 		st_ops->type_id = type_id;
 
-- 
2.46.0

Re: [PATCH] libbpf: Initialize st_ops->tname with strdup()

Posted by Andrii Nakryiko 1 year, 5 months ago

On Tue, Aug 20, 2024 at 11:48 PM Soma Nakata <soma.nakata01@gmail.com> wrote:
>
> `tname` is returned by `btf__name_by_offset()` as well as `var_name`,
> and these addresses point to strings in the btf. Since their locations
> may change while loading the bpf program, using `strdup()` ensures
> `tname` is safely stored.
>
> Signed-off-by: Soma Nakata <soma.nakata01@gmail.com>
> ---
>  tools/lib/bpf/libbpf.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index a3be6f8fac09..ece1f1af2cd4 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -1423,7 +1423,7 @@ static int init_struct_ops_maps(struct bpf_object *obj, const char *sec_name,
>                 memcpy(st_ops->data,
>                        data->d_buf + vsi->offset,
>                        type->size);
> -               st_ops->tname = tname;
> +               st_ops->tname = strdup(tname);
>                 st_ops->type = type;
>                 st_ops->type_id = type_id;
>

Thanks for the fix, but this has been fixed already ([0]). Please make
sure that you always reproduce the issue on bpf-next/master and send a
fix against that branch.

  [0] https://lore.kernel.org/bpf/20240724171459.281234-1-void@manifault.com/

pw-bot: cr

> --
> 2.46.0
>

Re: [PATCH] libbpf: Initialize st_ops->tname with strdup()

Posted by Christophe JAILLET 1 year, 5 months ago

Le 21/08/2024 à 08:46, Soma Nakata a écrit :
> `tname` is returned by `btf__name_by_offset()` as well as `var_name`,
> and these addresses point to strings in the btf. Since their locations
> may change while loading the bpf program, using `strdup()` ensures
> `tname` is safely stored.
> 
> Signed-off-by: Soma Nakata <soma.nakata01@gmail.com>
> ---
>   tools/lib/bpf/libbpf.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index a3be6f8fac09..ece1f1af2cd4 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -1423,7 +1423,7 @@ static int init_struct_ops_maps(struct bpf_object *obj, const char *sec_name,
>   		memcpy(st_ops->data,
>   		       data->d_buf + vsi->offset,
>   		       type->size);
> -		st_ops->tname = tname;
> +		st_ops->tname = strdup(tname);

Hi,

Should a NULL check be added (as done a few lines above for the 
[cm]alloc()) and bpf_map__destroy() updated with a 
zfree(&map->st_ops->tname) ?

CJ

>   		st_ops->type = type;
>   		st_ops->type_id = type_id;
>

Re: [PATCH] libbpf: Initialize st_ops->tname with strdup()

Posted by Soma Nakata 1 year, 5 months ago

Hi,

You're correct, I should add a NULL check.

zfree(&map->st_ops->tname) causes error because tname has
`const` qualifier.
Also, I found st_ops->type has the same issue.
Therefore, I propose removing `const` from `tname` and `type`
fields of `struct bpf_struct_ops`, and duplicating them from btf.

>
> Le 21/08/2024 à 08:46, Soma Nakata a écrit :
> > `tname` is returned by `btf__name_by_offset()` as well as `var_name`,
> > and these addresses point to strings in the btf. Since their locations
> > may change while loading the bpf program, using `strdup()` ensures
> > `tname` is safely stored.
> >
> > Signed-off-by: Soma Nakata <soma.nakata01@gmail.com>
> > ---
> >   tools/lib/bpf/libbpf.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> > index a3be6f8fac09..ece1f1af2cd4 100644
> > --- a/tools/lib/bpf/libbpf.c
> > +++ b/tools/lib/bpf/libbpf.c
> > @@ -1423,7 +1423,7 @@ static int init_struct_ops_maps(struct bpf_object *obj, const char *sec_name,
> >               memcpy(st_ops->data,
> >                      data->d_buf + vsi->offset,
> >                      type->size);
> > -             st_ops->tname = tname;
> > +             st_ops->tname = strdup(tname);
>
> Hi,
>
> Should a NULL check be added (as done a few lines above for the
> [cm]alloc()) and bpf_map__destroy() updated with a
> zfree(&map->st_ops->tname) ?
>
> CJ
>
> >               st_ops->type = type;
> >               st_ops->type_id = type_id;
> >
>

Re: [PATCH] libbpf: Initialize st_ops->tname with strdup()

Posted by Soma Nakata 1 year, 5 months ago

`type` field is supposed to directly point to the btf in functions
like `btf_members()`. So I will make change only to `tname` field
in this patch.

On Wed, Aug 21, 2024 at 6:04 PM Soma Nakata <soma.nakata01@gmail.com> wrote:
>
> Hi,
>
> You're correct, I should add a NULL check.
>
> zfree(&map->st_ops->tname) causes error because tname has
> `const` qualifier.
> Also, I found st_ops->type has the same issue.
> Therefore, I propose removing `const` from `tname` and `type`
> fields of `struct bpf_struct_ops`, and duplicating them from btf.
>
> >
> > Le 21/08/2024 à 08:46, Soma Nakata a écrit :
> > > `tname` is returned by `btf__name_by_offset()` as well as `var_name`,
> > > and these addresses point to strings in the btf. Since their locations
> > > may change while loading the bpf program, using `strdup()` ensures
> > > `tname` is safely stored.
> > >
> > > Signed-off-by: Soma Nakata <soma.nakata01@gmail.com>
> > > ---
> > >   tools/lib/bpf/libbpf.c | 2 +-
> > >   1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> > > index a3be6f8fac09..ece1f1af2cd4 100644
> > > --- a/tools/lib/bpf/libbpf.c
> > > +++ b/tools/lib/bpf/libbpf.c
> > > @@ -1423,7 +1423,7 @@ static int init_struct_ops_maps(struct bpf_object *obj, const char *sec_name,
> > >               memcpy(st_ops->data,
> > >                      data->d_buf + vsi->offset,
> > >                      type->size);
> > > -             st_ops->tname = tname;
> > > +             st_ops->tname = strdup(tname);
> >
> > Hi,
> >
> > Should a NULL check be added (as done a few lines above for the
> > [cm]alloc()) and bpf_map__destroy() updated with a
> > zfree(&map->st_ops->tname) ?
> >
> > CJ
> >
> > >               st_ops->type = type;
> > >               st_ops->type_id = type_id;
> > >
> >