[Bug bpf/24811] New: stapbpf segfault: nested foreach loops can corrupt sorted key data when limit==0

[Bug bpf/24811] New: stapbpf segfault: nested foreach loops can corrupt sorted key data when limit==0

[me at serhei dot io]

https://sourceware.org/bugzilla/show_bug.cgi?id=24811

            Bug ID: 24811
           Summary: stapbpf segfault: nested foreach loops can corrupt
                    sorted key data when limit==0
           Product: systemtap
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: bpf
          Assignee: systemtap at sourceware dot org
          Reporter: me at serhei dot io
  Target Milestone: ---

spotted this while working on pr23858 which is a rabbit hole of tricky
behaviour

The existing if (limit == 0) goto empty; -> empty: keys.pop_back() code
sequence in bpfinterp.cxx map_get_next_key() seemed fishy to me. Turns out you
can cause a segfault with nested foreach loops.

  foreach (k1- in a) { // push sorted data for a                          
    flag = flag && k1 == (0-a[k1]) // check data for a                          
    foreach (k2- in b) { // push sorted data for b                              
      flag = flag && k2 == b[k2] // check data for b                            
      foreach (k3- in a limit lim) { // bug -- don't push, pop sorted data for
b         
        flag = 0 // should not be invoked                                       
      } // bug -- after popping, will read sorted data for a on next iteration  
    } // pop sorted data for b, but with bug pops a                             
  } // pop sorted data for a, but with bug pops <nada> -- segfault?

Filing since I suspect a less convoluted set of loops will cause the same
thing.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug bpf/24811] stapbpf segfault: nested foreach loops can corrupt sorted key data when limit==0

[me at serhei dot io]

https://sourceware.org/bugzilla/show_bug.cgi?id=24811

Serhei Makarov <me at serhei dot io> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #1 from Serhei Makarov <me at serhei dot io> ---
Indeed, replacing 'limit 0' with 'limit lim' where lim is a variable will cause
the same segfault in existing foreach.stp testcase.

Luckily a one-line fix was possible. Committing separately ahead of pr23858
work.

-- 
You are receiving this mail because:
You are the assignee for the bug.