Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <tencent_0D62BF818D106C96C26594CAC76BF3281306@qq.com>
From:   Rong Tao <rtoax@foxmail.com>
To:     ast@kernel.org
Cc:     rongtao@cestc.cn, Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        Martin KaFai Lau <martin.lau@linux.dev>,
        Song Liu <song@kernel.org>, Yonghong Song <yhs@fb.com>,
        John Fastabend <john.fastabend@gmail.com>,
        KP Singh <kpsingh@kernel.org>,
        Stanislav Fomichev <sdf@google.com>,
        Hao Luo <haoluo@google.com>, Jiri Olsa <jolsa@kernel.org>,
        Mykola Lysenko <mykolal@fb.com>, Shuah Khan <shuah@kernel.org>,
        Nick Terrell <terrelln@fb.com>,
        bpf@vger.kernel.org (open list:BPF [GENERAL] (Safe Dynamic Programs and
        Tools)),
        linux-kselftest@vger.kernel.org (open list:KERNEL SELFTEST FRAMEWORK),
        linux-kernel@vger.kernel.org (open list)
Subject: [PATCH bpf-next] selftests/bpf: trace_helpers.c: Fix segfault
Date:   Sun,  9 Apr 2023 16:15:25 +0800
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Rong Tao <rongtao@cestc.cn>

When the number of symbols is greater than MAX_SYMS (300000), the access
array struct ksym syms[MAX_SYMS] goes out of bounds, which will result in
a segfault.

Resolve this issue by judging the maximum number and exiting the loop, and
increasing the default size appropriately. (6.2.9 = 329839 below)

    $ cat /proc/kallsyms | wc -l
    329839

    GDB debugging:
    $ cd linux/samples/bpf
    $ sudo gdb ./sampleip
    ...
    (gdb) r
    ...
    Program received signal SIGSEGV, Segmentation fault.
    0x00007ffff7e2debf in malloc () from /lib64/libc.so.6
    Missing separate debuginfos, use: dnf debuginfo-install
    elfutils-libelf-0.189-1.fc37.x86_64 glibc-2.36-9.fc37.x86_64
    libzstd-1.5.4-1.fc37.x86_64 zlib-1.2.12-5.fc37.x86_64
    (gdb) bt
    #0  0x00007ffff7e2debf in malloc () from /lib64/libc.so.6
    #1  0x00007ffff7e33f8e in strdup () from /lib64/libc.so.6
    #2  0x0000000000403fb0 in load_kallsyms_refresh() from trace_helpers.c
    #3  0x00000000004038b2 in main ()

Signed-off-by: Rong Tao <rongtao@cestc.cn>
---
 tools/testing/selftests/bpf/trace_helpers.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c
index 09a16a77bae4..a9d589c560d2 100644
--- a/tools/testing/selftests/bpf/trace_helpers.c
+++ b/tools/testing/selftests/bpf/trace_helpers.c
@@ -14,7 +14,7 @@
 
 #define DEBUGFS "/sys/kernel/debug/tracing/"
 
-#define MAX_SYMS 300000
+#define MAX_SYMS 400000
 static struct ksym syms[MAX_SYMS];
 static int sym_cnt;
 
@@ -44,7 +44,8 @@ int load_kallsyms_refresh(void)
 			continue;
 		syms[i].addr = (long) addr;
 		syms[i].name = strdup(func);
-		i++;
+		if (++i >= MAX_SYMS)
+			break;
 	}
 	fclose(f);
 	sym_cnt = i;
-- 
2.39.2