* [Bug bpf/24811] New: stapbpf segfault: nested foreach loops can corrupt sorted key data when limit==0
@ 2019-07-15 16:51 me at serhei dot io
2019-07-15 17:24 ` [Bug bpf/24811] " me at serhei dot io
0 siblings, 1 reply; 2+ messages in thread
From: me at serhei dot io @ 2019-07-15 16:51 UTC (permalink / raw)
To: systemtap
https://sourceware.org/bugzilla/show_bug.cgi?id=24811
Bug ID: 24811
Summary: stapbpf segfault: nested foreach loops can corrupt
sorted key data when limit==0
Product: systemtap
Version: unspecified
Status: NEW
Severity: normal
Priority: P2
Component: bpf
Assignee: systemtap at sourceware dot org
Reporter: me at serhei dot io
Target Milestone: ---
spotted this while working on pr23858 which is a rabbit hole of tricky
behaviour
The existing if (limit == 0) goto empty; -> empty: keys.pop_back() code
sequence in bpfinterp.cxx map_get_next_key() seemed fishy to me. Turns out you
can cause a segfault with nested foreach loops.
foreach (k1- in a) { // push sorted data for a
flag = flag && k1 == (0-a[k1]) // check data for a
foreach (k2- in b) { // push sorted data for b
flag = flag && k2 == b[k2] // check data for b
foreach (k3- in a limit lim) { // bug -- don't push, pop sorted data for
b
flag = 0 // should not be invoked
} // bug -- after popping, will read sorted data for a on next iteration
} // pop sorted data for b, but with bug pops a
} // pop sorted data for a, but with bug pops <nada> -- segfault?
Filing since I suspect a less convoluted set of loops will cause the same
thing.
--
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-07-15 17:24 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-15 16:51 [Bug bpf/24811] New: stapbpf segfault: nested foreach loops can corrupt sorted key data when limit==0 me at serhei dot io
2019-07-15 17:24 ` [Bug bpf/24811] " me at serhei dot io
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).