1. Patchew
  2. linux
  3. View series

[PATCH bpf-next v2] bpftool: Fix gen object segfault

Rong Tao posted 1 patch 1 year ago
There is a newer version of this series
tools/bpf/bpftool/gen.c | 10 ++++++++++
1 file changed, 10 insertions(+)
[PATCH bpf-next v2] bpftool: Fix gen object segfault
Posted by Rong Tao 1 year ago 
From: Rong Tao <rongtao@cestc.cn>

If the input file and output file are the same, the input file is cleared
due to opening, resulting in a NULL pointer access by libbpf.

    $ bpftool gen object prog.o prog.o
    libbpf: failed to get ELF header for prog.o: invalid `Elf' handle
    Segmentation fault

    (gdb) bt
    #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
    #1  bpf_linker__add_file (linker=0x4feda0, filename=<optimized out>, opts=<optimized out>) at linker.c:453
    #2  0x000000000040c235 in do_object ()
    #3  0x00000000004021d7 in main ()
    (gdb) frame 0
    #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
    1296		Elf64_Sym *sym = symtab->data->d_buf;

Signed-off-by: Rong Tao <rongtao@cestc.cn>
---
v1: https://lore.kernel.org/lkml/tencent_410B8166C55CD2AB64BDEA8E92204619180A@qq.com/
---
 tools/bpf/bpftool/gen.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
index 5a4d3240689e..506d205138db 100644
--- a/tools/bpf/bpftool/gen.c
+++ b/tools/bpf/bpftool/gen.c
@@ -1879,6 +1879,8 @@ static int do_object(int argc, char **argv)
 	struct bpf_linker *linker;
 	const char *output_file, *file;
 	int err = 0;
+	int argc_cpy = argc;
+	char **argv_cpy = argv;
 
 	if (!REQ_ARGS(2)) {
 		usage();
@@ -1887,6 +1889,14 @@ static int do_object(int argc, char **argv)
 
 	output_file = GET_ARG();
 
+	/* Ensure we don't overwrite any input file */
+	while (argc_cpy--) {
+		if (!strcmp(output_file, *argv_cpy++)) {
+			p_err("Input and output files cannot be the same");
+			goto out;
+		}
+	}
+
 	linker = bpf_linker__new(output_file, NULL);
 	if (!linker) {
 		p_err("failed to create BPF linker instance");
-- 
2.47.1
Re: [PATCH bpf-next v2] bpftool: Fix gen object segfault
Posted by Quentin Monnet 1 year ago 
On 05/12/2024 11:10, Rong Tao wrote:
> From: Rong Tao <rongtao@cestc.cn>
> 
> If the input file and output file are the same, the input file is cleared
> due to opening, resulting in a NULL pointer access by libbpf.
> 
>     $ bpftool gen object prog.o prog.o
>     libbpf: failed to get ELF header for prog.o: invalid `Elf' handle
>     Segmentation fault
> 
>     (gdb) bt
>     #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
>     #1  bpf_linker__add_file (linker=0x4feda0, filename=<optimized out>, opts=<optimized out>) at linker.c:453
>     #2  0x000000000040c235 in do_object ()
>     #3  0x00000000004021d7 in main ()
>     (gdb) frame 0
>     #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
>     1296		Elf64_Sym *sym = symtab->data->d_buf;
> 
> Signed-off-by: Rong Tao <rongtao@cestc.cn>
> ---
> v1: https://lore.kernel.org/lkml/tencent_410B8166C55CD2AB64BDEA8E92204619180A@qq.com/
> ---
>  tools/bpf/bpftool/gen.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
> index 5a4d3240689e..506d205138db 100644
> --- a/tools/bpf/bpftool/gen.c
> +++ b/tools/bpf/bpftool/gen.c
> @@ -1879,6 +1879,8 @@ static int do_object(int argc, char **argv)
>  	struct bpf_linker *linker;
>  	const char *output_file, *file;
>  	int err = 0;
> +	int argc_cpy = argc;
> +	char **argv_cpy = argv;


Oops sorry, argc_cpy and argv_cpy need to be initialised _after_ the
call to GET_ARG() below, otherwise we always start comparing output_file
with itself. Please test this code on your side, too :)

pw-bot: cr


>  
>  	if (!REQ_ARGS(2)) {
>  		usage();
> @@ -1887,6 +1889,14 @@ static int do_object(int argc, char **argv)
>  
>  	output_file = GET_ARG();
>  
> +	/* Ensure we don't overwrite any input file */
> +	while (argc_cpy--) {
> +		if (!strcmp(output_file, *argv_cpy++)) {
> +			p_err("Input and output files cannot be the same");
> +			goto out;
> +		}
> +	}
> +
>  	linker = bpf_linker__new(output_file, NULL);
>  	if (!linker) {
>  		p_err("failed to create BPF linker instance");
Re: [PATCH bpf-next v2] bpftool: Fix gen object segfault
Posted by Rong Tao 1 year ago 
On 12/5/24 19:20, Quentin Monnet wrote:
> On 05/12/2024 11:10, Rong Tao wrote:
>> From: Rong Tao <rongtao@cestc.cn>
>>
>> If the input file and output file are the same, the input file is cleared
>> due to opening, resulting in a NULL pointer access by libbpf.
>>
>>      $ bpftool gen object prog.o prog.o
>>      libbpf: failed to get ELF header for prog.o: invalid `Elf' handle
>>      Segmentation fault
>>
>>      (gdb) bt
>>      #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
>>      #1  bpf_linker__add_file (linker=0x4feda0, filename=<optimized out>, opts=<optimized out>) at linker.c:453
>>      #2  0x000000000040c235 in do_object ()
>>      #3  0x00000000004021d7 in main ()
>>      (gdb) frame 0
>>      #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
>>      1296		Elf64_Sym *sym = symtab->data->d_buf;
>>
>> Signed-off-by: Rong Tao <rongtao@cestc.cn>
>> ---
>> v1: https://lore.kernel.org/lkml/tencent_410B8166C55CD2AB64BDEA8E92204619180A@qq.com/
>> ---
>>   tools/bpf/bpftool/gen.c | 10 ++++++++++
>>   1 file changed, 10 insertions(+)
>>
>> diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
>> index 5a4d3240689e..506d205138db 100644
>> --- a/tools/bpf/bpftool/gen.c
>> +++ b/tools/bpf/bpftool/gen.c
>> @@ -1879,6 +1879,8 @@ static int do_object(int argc, char **argv)
>>   	struct bpf_linker *linker;
>>   	const char *output_file, *file;
>>   	int err = 0;
>> +	int argc_cpy = argc;
>> +	char **argv_cpy = argv;
>
> Oops sorry, argc_cpy and argv_cpy need to be initialised _after_ the
> call to GET_ARG() below, otherwise we always start comparing output_file
> with itself. Please test this code on your side, too :)
>
> pw-bot: cr

Sorry, i just test this patch in [1], and it's works, maybe the 
compile-flags is differenet.

I'll fix this and submit v2 soon, thanks!!

[1] https://github.com/libbpf/bpftool

>
>>   
>>   	if (!REQ_ARGS(2)) {
>>   		usage();
>> @@ -1887,6 +1889,14 @@ static int do_object(int argc, char **argv)
>>   
>>   	output_file = GET_ARG();
>>   
>> +	/* Ensure we don't overwrite any input file */
>> +	while (argc_cpy--) {
>> +		if (!strcmp(output_file, *argv_cpy++)) {
>> +			p_err("Input and output files cannot be the same");
>> +			goto out;
>> +		}
>> +	}
>> +
>>   	linker = bpf_linker__new(output_file, NULL);
>>   	if (!linker) {
>>   		p_err("failed to create BPF linker instance");

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.