BPF Archive on lore.kernel.org
 help / color / Atom feed
* Bugs with libbpf
@ 2020-01-15  6:35 Benjamin Nilsen
  2020-02-11 20:01 ` Andrii Nakryiko
  0 siblings, 1 reply; 2+ messages in thread
From: Benjamin Nilsen @ 2020-01-15  6:35 UTC (permalink / raw)
  To: bpf

[-- Attachment #1: Type: text/plain, Size: 469 bytes --]

Hello,

I believe I found some bugs with libbpf and just wanted to share them here.
I have attached them below.

Regards,
Ben


The first one:
I believe there is an error with: libbpf_nla_dump_errormsg();

The second one:
libbpf_nla_parse();

Third one:
I believe there is a stack buffer overflow with the method
bpf_object__open_buffer() when running the attached program with the
input:
./LibbpfTest15.c (executable version) LibbpfTest15buginput LibbpfTest15buginput

[-- Attachment #2: LibbpfTest15.c --]
[-- Type: application/octet-stream, Size: 2121 bytes --]

[-- Attachment #3: LibbpfTest5.c --]
[-- Type: application/octet-stream, Size: 1435 bytes --]

[-- Attachment #4: libbpfTest4bug --]
[-- Type: application/octet-stream, Size: 1024 bytes --]

[-- Attachment #5: LibbpfTest15buginput --]
[-- Type: application/octet-stream, Size: 808 bytes --]

[-- Attachment #6: LibbpfTest4.c --]
[-- Type: application/octet-stream, Size: 1726 bytes --]

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: Bugs with libbpf
  2020-01-15  6:35 Bugs with libbpf Benjamin Nilsen
@ 2020-02-11 20:01 ` Andrii Nakryiko
  0 siblings, 0 replies; 2+ messages in thread
From: Andrii Nakryiko @ 2020-02-11 20:01 UTC (permalink / raw)
  To: Benjamin Nilsen; +Cc: bpf

On Tue, Jan 14, 2020 at 10:35 PM Benjamin Nilsen <bcnilsen@ucdavis.edu> wrote:
>
> Hello,
>
> I believe I found some bugs with libbpf and just wanted to share them here.
> I have attached them below.
>
> Regards,
> Ben
>
>
> The first one:
> I believe there is an error with: libbpf_nla_dump_errormsg();
>
> The second one:
> libbpf_nla_parse();

Can you please expand on what the bugs are, specifically? It will help
direct libbpf developer's attention to fixing bugs, thanks.

>
> Third one:
> I believe there is a stack buffer overflow with the method
> bpf_object__open_buffer() when running the attached program with the
> input:
> ./LibbpfTest15.c (executable version) LibbpfTest15buginput LibbpfTest15buginput

Yyou code calls bpf_object__load() unconditionally, even if
bpf_object__open_buffer fails (which it obviously does in this case,
as you are giving it a random 5 bytes as an ELF file). Again, there
might be bugs, but please be more specific.

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-15  6:35 Bugs with libbpf Benjamin Nilsen
2020-02-11 20:01 ` Andrii Nakryiko

BPF Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/bpf/0 bpf/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 bpf bpf/ https://lore.kernel.org/bpf \
		bpf@vger.kernel.org
	public-inbox-index bpf

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.bpf


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git