| Message ID | 20230428155035.530862-1-iii@linux.ibm.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | BPF |
| Headers | show |
| Series | [bpf-next] libbpf: Fix overflow detection when dumping bitfields | expand |
On 4/28/23 8:50 AM, Ilya Leoshkevich wrote: > btf_dump test fails on s390x with the following error: > > unexpected return value dumping fs_context: actual -7 != expected 280 > > This happens when processing the fs_context.phase member: its type size > is 4, but there are less bytes left until the end of the struct. The > problem is that btf_dump_type_data_check_overflow() does not handle > bitfields. > > Add bitfield support; make sure that byte boundaries, which are > computed from bit boundaries, are rounded up. Ilya, Martin has submitted a patch yesterday to fix the issue: https://lore.kernel.org/bpf/20230428013638.1581263-1-martin.lau@linux.dev/ > > Fixes: 920d16af9b42 ("libbpf: BTF dumper support for typed data") > Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> > --- > tools/lib/bpf/btf_dump.c | 12 +++++++++--- > 1 file changed, 9 insertions(+), 3 deletions(-) > > diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c > index 580985ee5545..f8b538e8d753 100644 > --- a/tools/lib/bpf/btf_dump.c > +++ b/tools/lib/bpf/btf_dump.c > @@ -2250,9 +2250,11 @@ static int btf_dump_type_data_check_overflow(struct btf_dump *d, > const struct btf_type *t, > __u32 id, > const void *data, > - __u8 bits_offset) > + __u8 bits_offset, > + __u8 bit_sz) > { > __s64 size = btf__resolve_size(d->btf, id); > + const void *end; > > if (size < 0 || size >= INT_MAX) { > pr_warn("unexpected size [%zu] for id [%u]\n", > @@ -2280,7 +2282,11 @@ static int btf_dump_type_data_check_overflow(struct btf_dump *d, > case BTF_KIND_PTR: > case BTF_KIND_ENUM: > case BTF_KIND_ENUM64: > - if (data + bits_offset / 8 + size > d->typed_dump->data_end) > + if (bit_sz) > + end = data + (bits_offset + bit_sz + 7) / 8; > + else > + end = data + (bits_offset + 7) / 8 + size; > + if (end > d->typed_dump->data_end) > return -E2BIG; > break; > default: > @@ -2407,7 +2413,7 @@ static int btf_dump_dump_type_data(struct btf_dump *d, > { > int size, err = 0; > > - size = btf_dump_type_data_check_overflow(d, t, id, data, bits_offset); > + size = btf_dump_type_data_check_overflow(d, t, id, data, bits_offset, bit_sz); > if (size < 0) > return size; > err = btf_dump_type_data_check_zero(d, t, id, data, bits_offset, bit_sz);
diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c index 580985ee5545..f8b538e8d753 100644 --- a/tools/lib/bpf/btf_dump.c +++ b/tools/lib/bpf/btf_dump.c @@ -2250,9 +2250,11 @@ static int btf_dump_type_data_check_overflow(struct btf_dump *d, const struct btf_type *t, __u32 id, const void *data, - __u8 bits_offset) + __u8 bits_offset, + __u8 bit_sz) { __s64 size = btf__resolve_size(d->btf, id); + const void *end; if (size < 0 || size >= INT_MAX) { pr_warn("unexpected size [%zu] for id [%u]\n", @@ -2280,7 +2282,11 @@ static int btf_dump_type_data_check_overflow(struct btf_dump *d, case BTF_KIND_PTR: case BTF_KIND_ENUM: case BTF_KIND_ENUM64: - if (data + bits_offset / 8 + size > d->typed_dump->data_end) + if (bit_sz) + end = data + (bits_offset + bit_sz + 7) / 8; + else + end = data + (bits_offset + 7) / 8 + size; + if (end > d->typed_dump->data_end) return -E2BIG; break; default: @@ -2407,7 +2413,7 @@ static int btf_dump_dump_type_data(struct btf_dump *d, { int size, err = 0; - size = btf_dump_type_data_check_overflow(d, t, id, data, bits_offset); + size = btf_dump_type_data_check_overflow(d, t, id, data, bits_offset, bit_sz); if (size < 0) return size; err = btf_dump_type_data_check_zero(d, t, id, data, bits_offset, bit_sz);
btf_dump test fails on s390x with the following error: unexpected return value dumping fs_context: actual -7 != expected 280 This happens when processing the fs_context.phase member: its type size is 4, but there are less bytes left until the end of the struct. The problem is that btf_dump_type_data_check_overflow() does not handle bitfields. Add bitfield support; make sure that byte boundaries, which are computed from bit boundaries, are rounded up. Fixes: 920d16af9b42 ("libbpf: BTF dumper support for typed data") Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> --- tools/lib/bpf/btf_dump.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)