Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix a segfault caused by passing a non-null buffer to bpf_prog_load #59

Merged
merged 2 commits into from
Sep 11, 2019

Conversation

snowp
Copy link
Contributor

@snowp snowp commented Sep 10, 2019

During error handling bcc will attempt to write the message to the
provided buffer. It checks for a provided buffer either by checking the
log_buf_size parameter or by checking log_buf to see if it's non-null.

Because of the inconsistent checks on bcc's side and the specific
parameters that rust-bcc passes, this is only a problem when the call to
bpf_prog_load returns certain errors.

The flow that causes the segfault looks like this: rust-bcc sets log_level=0,log_size=0
as the initial parameters. bcc will issue the syscall, but upon failure will reissue
the bcc_prog_load_xattr with log_level set to 1. At this point, the same error will be
produced and outputted to a new, temporary buffer (since the provided
log_size is 0). Following this, it will attempt to log to the user provided
buffer as log_level is now > 0, checking to see if the provided buffer
is non-null. As rust-bcc provided a non-null ptr, bcc attempts to write
to a zero buffer which causes a SIGSEGV.

Relevant links:
Checks for log_buf_size:
https://github.com/iovisor/bcc/blob/d147588ebe35b7cd2b4d253a7da18bef253ea78d/src/cc/libbpf.c#L519

Checks for log_buf:
https://github.com/iovisor/bcc/blob/d147588ebe35b7cd2b4d253a7da18bef253ea78d/src/cc/libbpf.c#L641

During error handling bcc will attempt to write the message to the
provided buffer. It checks for a provided buffer either by checking the
log_buf_size parameter or by checking log_buf to see if it's non-null.

Because of the inconsistent checks on bcc's side and the specific
parameters that rust-bcc passes, this is only a problem when the call to
bpf_prog_load returns certain errors.

The flow that causes the segfault looks like this: rust-bcc sets log_level=0,log_size=0
as the initial parameters. bcc will issue the syscall, but upon failure will reissue
the bcc_prog_load_xattr with log_level set to 1. At this point, the same error will be
produced and outputted to a new, temporary buffer (since the provided
log_size is 0). Following this, it will attempt to log to the user provided
buffer as log_level is now > 0, checking to see if the provided buffer
is non-null. As rust-bcc provided a non-null ptr, bcc attempts to write
to a zero buffer which causes a SIGSEGV.

Relevant links:
Checks for log_buf_size:
https://github.com/iovisor/bcc/blob/d147588ebe35b7cd2b4d253a7da18bef253ea78d/src/cc/libbpf.c#L519

Checks for log_buf:
https://github.com/iovisor/bcc/blob/d147588ebe35b7cd2b4d253a7da18bef253ea78d/src/cc/libbpf.c#L641
@snowp snowp changed the title fixes a segfault caused by passing a non-null buffer to bpf_prog_load fix a segfault caused by passing a non-null buffer to bpf_prog_load Sep 10, 2019
@brayniac
Copy link
Collaborator

Awesome! Thanks for the PR!

@brayniac brayniac merged commit da3a1f7 into rust-bpf:master Sep 11, 2019
@brayniac brayniac mentioned this pull request Sep 13, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants