Bugs with libbpf

Bugs with libbpf

[Benjamin Nilsen]

[-- Attachment #1: Type: text/plain, Size: 469 bytes --]

Hello,

I believe I found some bugs with libbpf and just wanted to share them here.
I have attached them below.

Regards,
Ben


The first one:
I believe there is an error with: libbpf_nla_dump_errormsg();

The second one:
libbpf_nla_parse();

Third one:
I believe there is a stack buffer overflow with the method
bpf_object__open_buffer() when running the attached program with the
input:
./LibbpfTest15.c (executable version) LibbpfTest15buginput LibbpfTest15buginput

[-- Attachment #2: LibbpfTest15.c --]
[-- Type: application/octet-stream, Size: 2121 bytes --]

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <memory.h>
#include <unistd.h>
#include <asm/unistd.h>
#include <linux/bpf.h>
#include "bpf.h"
//#include "libbpf2.h"
#include <errno.h>
#include "nlattr.h"
#include <linux/rtnetlink.h>
#include <sys/socket.h>
#include "libbpf.h"
#include <sys/types.h>  // for size_t


int main(int argc, char **argv){


typedef struct args{

int err;
char buf[100];
size_t size;
size_t offset;

int buffer[150];
int flags;

size_t obj_buf_sz;
char name;


char name1;
int rand1;
int rand2;
int rand3;
int rand4;
bool b1;

} args_t;

args_t pta;


/*
printf("Opening the file\n");

FILE *fp;
fp = fopen(argv[1], "rb");
printf("File name is: %s\n", argv[1]);
printf("File was opened\n");

struct bpf_object;
struct bpf_object *bo;

bo = bpf_object__open(argv[1]);

printf("Opening bpf Object with argv[1]\n");
bpf_object__open(argv[1]);

//bpf_object__open(argv[1]);
*/


struct bpf_object;
struct bpf_object *bo;

printf("Opening the file\n");


FILE *fp;
fp = fopen(argv[1], "rb");
printf("File name is: %s\n", argv[1]);
printf("File was opened\n");
if(fread(&pta, sizeof(pta), 1, fp) != 1){
        printf("File not big enough\n");
        fclose(fp);
        return 0;
}


FILE *fp2;
fp2 = fopen(argv[2], "rb");
printf("File name is: %s\n", argv[2]);
printf("Second File was opened\n");
if(fread(&pta, sizeof(pta), 1, fp2) != 1){
        printf("File not big enough\n");
        fclose(fp2);
        return 0;
}


printf("\nOpening bpf object via: bpf_object__open_buffer()\n");
char name5 = "a";
size_t obj_buf_sz = 5;
bo = bpf_object__open_buffer(argv[1], pta.obj_buf_sz, &pta.name);
printf("Opened a bpf file with bpf_object__open_buffer()\n\n");


if (bo == NULL){

	printf("Returned: Invalid BPF_Prog\n");
	return 0;
}

printf("Calling methods that use the bpf objects");

bpf_object__load(&bo);

bpf_object__kversion(&bo);

bpf_object__btf(&bo);

bpf_object__btf_fd(&bo);

bpf_object__unload(&bo);












//enum bpf_prog_type prog_type = BPF_PROG_TYPE_TRACEPOINT;

fclose(fp);
fclose(fp2);

printf("Test complete. Opened a bpf_program.\n");


return 0;
}

[-- Attachment #3: LibbpfTest5.c --]
[-- Type: application/octet-stream, Size: 1435 bytes --]

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <memory.h>
#include <unistd.h>
#include <asm/unistd.h>
#include <linux/bpf.h>
#include "bpf.h"
#include "libbpf2.h"
#include <errno.h>
#include "nlattr.h"
#include <linux/rtnetlink.h>


int main(int argc, char **argv){


typedef struct args{

    int one;
    int two;
    int maxtype;
    int len;
	bool b1;
	bool b2;
	bool b3;
	bool b4;
    int size;
    struct nlattr nl;

    struct nlattr head;
    struct libbpf_nla_policy policy;


} args_t;

args_t pta;




printf("Driver program for nlattr.c class\n");

printf("Opening the file\n");

FILE *fp;
fp = fopen(argv[1], "rb");
printf("File name is: %s\n", argv[1]);
printf("File was opened\n");
if(fread(&pta, sizeof(pta), 1, fp) != 1){
        printf("File not big enough\n");
        fclose(fp);
        return 0;
}







//printf("Calling libbpf_nla_dump_errormsg\n");
//libbpf_nla_dump_errormsg(&nlh);
//libbpf_nla_parse(struct nlattr *tb[], int maxtype, struct nlattr *head,
//             int len, struct libbpf_nla_policy *policy);



int size = 5;


if(pta.size > 0 && pta. size < 999999){
    size = pta.size;
}

struct nlattr tb[size];


for(int i = 0; i < size; i++){
    tb[i] = pta.nl;
}



struct nlattr head;
struct libbpf_nla_policy policy;

printf("Calling libbpf_nla_parse\n");

libbpf_nla_parse(&tb, pta.maxtype, &pta.head,
pta.len, &pta.policy);



printf("Test complete.\n");


return 0;
}

[-- Attachment #4: libbpfTest4bug --]
[-- Type: application/octet-stream, Size: 1024 bytes --]

[-- Attachment #5: LibbpfTest15buginput --]
[-- Type: application/octet-stream, Size: 808 bytes --]

[-- Attachment #6: LibbpfTest4.c --]
[-- Type: application/octet-stream, Size: 1726 bytes --]

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <memory.h>
#include <unistd.h>
#include <asm/unistd.h>
#include <linux/bpf.h>
#include "bpf.h"
#include "libbpf2.h"
#include <errno.h>
#include "nlattr.h"
#include <linux/rtnetlink.h>


int main(int argc, char **argv){


typedef struct args{

    int one;
    int two;
	bool b1;
	bool b2;
	bool b3;
	bool b4;
	__u32 nlmsg_len;    /* Length of message including header */
    __u16 nlmsg_type;   /* Type of message content */
    __u16 nlmsg_flags;  /* Additional flags */
    __u32 nlmsg_seq;    /* Sequence number */
    __u32 nlmsg_pid;    /* Sender port ID */


} args_t;

args_t pta;




printf("Driver program for nlattr.c class\n");

printf("Opening the file\n");

FILE *fp;
fp = fopen(argv[1], "rb");
printf("File name is: %s\n", argv[1]);
printf("File was opened\n");
if(fread(&pta, sizeof(pta), 1, fp) != 1){
        printf("File not big enough\n");
        fclose(fp);
        return 0;
}




struct nlmsghdr {
    __u32 nlmsg_len;    /* Length of message including header */
    __u16 nlmsg_type;   /* Type of message content */
    __u16 nlmsg_flags;  /* Additional flags */
    __u32 nlmsg_seq;    /* Sequence number */
    __u32 nlmsg_pid;    /* Sender port ID */
};


struct nlmsghdr nlh;
    nlh.nlmsg_len = pta.nlmsg_len;    /* Length of message including header */
    nlh.nlmsg_type = pta.nlmsg_type;   /* Type of message content */
    nlh.nlmsg_flags = pta.nlmsg_flags;  /* Additional flags */
    nlh.nlmsg_seq = pta.nlmsg_seq;    /* Sequence number */
    nlh.nlmsg_pid = pta.nlmsg_pid;    /* Sender port ID */

printf("Calling libbpf_nla_dump_errormsg\n");
libbpf_nla_dump_errormsg(&nlh);



printf("Test complete.\n");


return 0;
}

Re: Bugs with libbpf

[Andrii Nakryiko]

On Tue, Jan 14, 2020 at 10:35 PM Benjamin Nilsen <bcnilsen@ucdavis.edu> wrote:
>
> Hello,
>
> I believe I found some bugs with libbpf and just wanted to share them here.
> I have attached them below.
>
> Regards,
> Ben
>
>
> The first one:
> I believe there is an error with: libbpf_nla_dump_errormsg();
>
> The second one:
> libbpf_nla_parse();

Can you please expand on what the bugs are, specifically? It will help
direct libbpf developer's attention to fixing bugs, thanks.

>
> Third one:
> I believe there is a stack buffer overflow with the method
> bpf_object__open_buffer() when running the attached program with the
> input:
> ./LibbpfTest15.c (executable version) LibbpfTest15buginput LibbpfTest15buginput

Yyou code calls bpf_object__load() unconditionally, even if
bpf_object__open_buffer fails (which it obviously does in this case,
as you are giving it a random 5 bytes as an ELF file). Again, there
might be bugs, but please be more specific.