linux-kernel - Re: [PATCH bpf-next v4 1/2] bpftool: Fix gen object segfault

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAADnVQKRSjV61=Yza_K0Mvyv1kK_hU-+4PhPzzR5dBDg=VDGrQ@mail.gmail.com>
Date: Thu, 5 Dec 2024 18:13:56 -0800
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Rong Tao <rtoax@...mail.com>
Cc: Andrii Nakryiko <andrii.nakryiko@...il.com>, Quentin Monnet <qmo@...nel.org>, 
	Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>, 
	Andrii Nakryiko <andrii@...nel.org>, rongtao@...tc.cn, 
	Martin KaFai Lau <martin.lau@...ux.dev>, Eduard Zingerman <eddyz87@...il.com>, Song Liu <song@...nel.org>, 
	Yonghong Song <yonghong.song@...ux.dev>, John Fastabend <john.fastabend@...il.com>, 
	KP Singh <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>, 
	Jiri Olsa <jolsa@...nel.org>, 
	"open list:BPF [TOOLING] (bpftool)" <bpf@...r.kernel.org>, open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf-next v4 1/2] bpftool: Fix gen object segfault

On Thu, Dec 5, 2024 at 6:01 PM Rong Tao <rtoax@...mail.com> wrote:
>
> From: Rong Tao <rongtao@...tc.cn>
>
> If the input file and output file are the same, the input file is cleared
> due to opening, resulting in a NULL pointer access by libbpf.
>
>     $ bpftool gen object prog.o prog.o
>     libbpf: failed to get ELF header for prog.o: invalid `Elf' handle
>     Segmentation fault
>
>     (gdb) bt
>     #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
>     #1  bpf_linker__add_file (linker=0x4feda0, filename=<optimized out>, opts=<optimized out>) at linker.c:453
>     #2  0x000000000040c235 in do_object ()
>     #3  0x00000000004021d7 in main ()
>     (gdb) frame 0
>     #0  0x0000000000450285 in linker_append_elf_syms (linker=0x4feda0, obj=0x7fffffffe100) at linker.c:1296
>     1296                Elf64_Sym *sym = symtab->data->d_buf;
>
> Signed-off-by: Rong Tao <rongtao@...tc.cn>
> ---
>  tools/bpf/bpftool/gen.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
>
> diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
> index 5a4d3240689e..e5e3e8705cc7 100644
> --- a/tools/bpf/bpftool/gen.c
> +++ b/tools/bpf/bpftool/gen.c
> @@ -1879,6 +1879,8 @@ static int do_object(int argc, char **argv)
>         struct bpf_linker *linker;
>         const char *output_file, *file;
>         int err = 0;
> +       int argc_cpy;
> +       char **argv_cpy;
>
>         if (!REQ_ARGS(2)) {
>                 usage();
> @@ -1887,6 +1889,17 @@ static int do_object(int argc, char **argv)
>
>         output_file = GET_ARG();
>
> +       argc_cpy = argc;
> +       argv_cpy = argv;
> +
> +       /* Ensure we don't overwrite any input file */
> +       while (argc_cpy--) {
> +               if (!strcmp(output_file, *argv_cpy++)) {
> +                       p_err("Input and output files cannot be the same");
> +                       goto out;

This is completely broken. Just because the names are different
doesn't mean that they don't point to the same file.

Fix the root cause of segfault instead.

pw-bot: cr