All of lore.kernel.org
 help / color / mirror / Atom feed
From: Alan Maguire <alan.maguire@oracle.com>
To: ast@kernel.org, daniel@iogearbox.net, yhs@fb.com
Cc: kafai@fb.com, songliubraving@fb.com, andriin@fb.com,
	john.fastabend@gmail.com, kpsingh@chromium.org,
	linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
	bpf@vger.kernel.org, Alan Maguire <alan.maguire@oracle.com>
Subject: [RFC PATCH bpf-next 2/6] bpf: btf->resolved_[ids,sizes] should not be used for vmlinux BTF
Date: Fri, 17 Apr 2020 11:42:36 +0100	[thread overview]
Message-ID: <1587120160-3030-3-git-send-email-alan.maguire@oracle.com> (raw)
In-Reply-To: <1587120160-3030-1-git-send-email-alan.maguire@oracle.com>

When testing support for print data structures using patches
later in this series, I hit NULL pointer dereference bugs when
printing "struct sk_buff". The problem seems to revolve around
that structure's use of a zero-length array in the middle of
the data structure - headers_start[0].

We see in btf_type_id_size() we consult btf->resolved_ids and
btf->resolved_sizes; both of which are not used in kernel
vmlinux BTF so should not be used when handling vmlinux
BTF data.

Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
---
 kernel/bpf/btf.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 50080ad..a474839 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -1170,7 +1170,7 @@ const struct btf_type *btf_type_id_size(const struct btf *btf,
 
 	if (btf_type_has_size(size_type)) {
 		size = size_type->size;
-	} else if (btf_type_is_array(size_type)) {
+	} else if (btf_type_is_array(size_type) && btf->resolved_sizes) {
 		size = btf->resolved_sizes[size_type_id];
 	} else if (btf_type_is_ptr(size_type)) {
 		size = sizeof(void *);
@@ -1179,6 +1179,9 @@ const struct btf_type *btf_type_id_size(const struct btf *btf,
 				 !btf_type_is_var(size_type)))
 			return NULL;
 
+		if (!btf->resolved_ids)
+			return NULL;
+
 		size_type_id = btf->resolved_ids[size_type_id];
 		size_type = btf_type_by_id(btf, size_type_id);
 		if (btf_type_nosize_or_null(size_type))
-- 
1.8.3.1


  parent reply	other threads:[~2020-04-17 10:43 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-17 10:42 [RFC PATCH bpf-next 0/6] bpf, printk: add BTF-based type printing Alan Maguire
2020-04-17 10:42 ` [RFC PATCH bpf-next 1/6] bpf: provide function to get vmlinux BTF information Alan Maguire
2020-04-17 10:42 ` Alan Maguire [this message]
2020-04-17 10:42 ` [RFC PATCH bpf-next 3/6] bpf: move to generic BTF show support, apply it to seq files/strings Alan Maguire
2020-04-17 10:42 ` [RFC PATCH bpf-next 4/6] checkpatch: add new BTF pointer format specifier Alan Maguire
2020-04-17 10:42 ` [RFC PATCH bpf-next 5/6] printk: add type-printing %pT<type> format specifier which uses BTF Alan Maguire
2020-04-29 12:09   ` Rasmus Villemoes
2020-04-17 10:42 ` [RFC PATCH bpf-next 6/6] printk: extend test_printf to test %pT BTF-based format specifier Alan Maguire
2020-04-17 16:47 ` [RFC PATCH bpf-next 0/6] bpf, printk: add BTF-based type printing Arnaldo Carvalho de Melo
2020-04-17 17:06   ` Alan Maguire
2020-04-18 16:05 ` Alexei Starovoitov
2020-04-18 20:31   ` Arnaldo Melo
2020-04-20 15:29   ` Alan Maguire
2020-04-20 16:32     ` Joe Perches
2020-04-29 12:15       ` Rasmus Villemoes
2020-04-30 10:03       ` Alan Maguire
2020-05-02  0:25         ` Joe Perches
2020-04-20 20:54   ` Arnaldo Carvalho de Melo

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1587120160-3030-3-git-send-email-alan.maguire@oracle.com \
    --to=alan.maguire@oracle.com \
    --cc=andriin@fb.com \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=john.fastabend@gmail.com \
    --cc=kafai@fb.com \
    --cc=kpsingh@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=songliubraving@fb.com \
    --cc=yhs@fb.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.