mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-28 21:45:01 +08:00
fc3a5534e2
An issue occurred while reading an ELF file in libbpf.c during fuzzing: Program received signal SIGSEGV, Segmentation fault. 0x0000000000958e97 in bpf_object.collect_prog_relos () at libbpf.c:4206 4206 in libbpf.c (gdb) bt #0 0x0000000000958e97 in bpf_object.collect_prog_relos () at libbpf.c:4206 #1 0x000000000094f9d6 in bpf_object.collect_relos () at libbpf.c:6706 #2 0x000000000092bef3 in bpf_object_open () at libbpf.c:7437 #3 0x000000000092c046 in bpf_object.open_mem () at libbpf.c:7497 #4 0x0000000000924afa in LLVMFuzzerTestOneInput () at fuzz/bpf-object-fuzzer.c:16 #5 0x000000000060be11 in testblitz_engine::fuzzer::Fuzzer::run_one () #6 0x000000000087ad92 in tracing::span::Span::in_scope () #7 0x00000000006078aa in testblitz_engine::fuzzer::util::walkdir () #8 0x00000000005f3217 in testblitz_engine::entrypoint::main::{{closure}} () #9 0x00000000005f2601 in main () (gdb) scn_data was null at this code(tools/lib/bpf/src/libbpf.c): if (rel->r_offset % BPF_INSN_SZ || rel->r_offset >= scn_data->d_size) { The scn_data is derived from the code above: scn = elf_sec_by_idx(obj, sec_idx); scn_data = elf_sec_data(obj, scn); relo_sec_name = elf_sec_str(obj, shdr->sh_name); sec_name = elf_sec_name(obj, scn); if (!relo_sec_name || !sec_name)// don't check whether scn_data is NULL return -EINVAL; In certain special scenarios, such as reading a malformed ELF file, it is possible that scn_data may be a null pointer Signed-off-by: Mingyi Zhang <zhangmingyi5@huawei.com> Signed-off-by: Xin Liu <liuxin350@huawei.com> Signed-off-by: Changye Wu <wuchangye@huawei.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20231221033947.154564-1-liuxin350@huawei.com |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| bpf_core_read.h | ||
| bpf_endian.h | ||
| bpf_gen_internal.h | ||
| bpf_helpers.h | ||
| bpf_prog_linfo.c | ||
| bpf_tracing.h | ||
| bpf.c | ||
| bpf.h | ||
| btf_dump.c | ||
| btf.c | ||
| btf.h | ||
| Build | ||
| elf.c | ||
| gen_loader.c | ||
| hashmap.c | ||
| hashmap.h | ||
| libbpf_common.h | ||
| libbpf_errno.c | ||
| libbpf_internal.h | ||
| libbpf_legacy.h | ||
| libbpf_probes.c | ||
| libbpf_version.h | ||
| libbpf.c | ||
| libbpf.h | ||
| libbpf.map | ||
| libbpf.pc.template | ||
| linker.c | ||
| Makefile | ||
| netlink.c | ||
| nlattr.c | ||
| nlattr.h | ||
| relo_core.c | ||
| relo_core.h | ||
| ringbuf.c | ||
| skel_internal.h | ||
| str_error.c | ||
| str_error.h | ||
| strset.c | ||
| strset.h | ||
| usdt.bpf.h | ||
| usdt.c | ||
| zip.c | ||
| zip.h | ||