netdev - Re: [PATCH bpf-next] tools build: propagate build failures from tools/build/Makefile.build

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 2 Aug 2020 11:22:07 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Jiri Olsa <jolsa@...hat.com>
Cc:     Andrii Nakryiko <andriin@...com>, bpf <bpf@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Kernel Team <kernel-team@...com>, Jiri Olsa <jolsa@...nel.org>,
        Arnaldo Carvalho de Melo <acme@...hat.com>
Subject: Re: [PATCH bpf-next] tools build: propagate build failures from tools/build/Makefile.build

On Sun, Aug 2, 2020 at 9:11 AM Jiri Olsa <jolsa@...hat.com> wrote:
>
> On Thu, Jul 30, 2020 at 07:42:44PM -0700, Andrii Nakryiko wrote:
> > The '&&' command seems to have a bad effect when $(cmd_$(1)) exits with
> > non-zero effect: the command failure is masked (despite `set -e`) and all but
> > the first command of $(dep-cmd) is executed (successfully, as they are mostly
> > printfs), thus overall returning 0 in the end.
>
> nice, thanks for digging into this,
> any idea why is the failure masked?

Two things.

1. In make, assume you have command f = a in one function and g = b; c
in another. If you write f && g, you end up with (a && b); c, right?

2. Try this shell script:

set -ex
false && true
true

It will return success. It won't execute the first true command, as
expected, but won't terminate the shell as you'd expect from set -e.

So basically, having a "logical operator" in a sequence of commands
negates the effect of `set -e`. Intuitively I'd expect that from ||,
but seems like && does that as well. if [] has similar effect -- any
failing command in an if check doesn't trigger an early termination of
a script.

>
> Acked-by: Jiri Olsa <jolsa@...hat.com>
>
> jirka
>
> >
> > This means in practice that despite compilation errors, tools's build Makefile
> > will return success. We see this very reliably with libbpf's Makefile, which
> > doesn't get compilation error propagated properly. This in turns causes issues
> > with selftests build, as well as bpftool and other projects that rely on
> > building libbpf.
> >
> > The fix is simple: don't use &&. Given `set -e`, we don't need to chain
> > commands with &&. The shell will exit on first failure, giving desired
> > behavior and propagating error properly.
> >
> > Cc: Jiri Olsa <jolsa@...nel.org>
> > Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
> > Fixes: 275e2d95591e ("tools build: Move dependency copy into function")
> > Signed-off-by: Andrii Nakryiko <andriin@...com>
> > ---
> >
> > I'm sending this against bpf-next tree, given libbpf is affected enough for me
> > to debug this fun problem that no one seemed to notice (or care, at least) in
> > almost 5 years. If there is a better kernel tree, please let me know.
> >
> >  tools/build/Build.include | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/tools/build/Build.include b/tools/build/Build.include
> > index 9ec01f4454f9..585486e40995 100644
> > --- a/tools/build/Build.include
> > +++ b/tools/build/Build.include
> > @@ -74,7 +74,8 @@ dep-cmd = $(if $(wildcard $(fixdep)),
> >  #                   dependencies in the cmd file
> >  if_changed_dep = $(if $(strip $(any-prereq) $(arg-check)),         \
> >                    @set -e;                                         \
> > -                  $(echo-cmd) $(cmd_$(1)) && $(dep-cmd))
> > +                  $(echo-cmd) $(cmd_$(1));                         \
> > +                  $(dep-cmd))
> >
> >  # if_changed      - execute command if any prerequisite is newer than
> >  #                   target, or command line has changed
> > --
> > 2.24.1
> >
>