From: "me at serhei dot io" <sourceware-bugzilla@sourceware.org>
To: systemtap@sourceware.org
Subject: [Bug bpf/24811] New: stapbpf segfault: nested foreach loops can corrupt sorted key data when limit==0
Date: Mon, 15 Jul 2019 16:51:00 -0000 [thread overview]
Message-ID: <bug-24811-6586@http.sourceware.org/bugzilla/> (raw)
https://sourceware.org/bugzilla/show_bug.cgi?id=24811
Bug ID: 24811
Summary: stapbpf segfault: nested foreach loops can corrupt
sorted key data when limit==0
Product: systemtap
Version: unspecified
Status: NEW
Severity: normal
Priority: P2
Component: bpf
Assignee: systemtap at sourceware dot org
Reporter: me at serhei dot io
Target Milestone: ---
spotted this while working on pr23858 which is a rabbit hole of tricky
behaviour
The existing if (limit == 0) goto empty; -> empty: keys.pop_back() code
sequence in bpfinterp.cxx map_get_next_key() seemed fishy to me. Turns out you
can cause a segfault with nested foreach loops.
foreach (k1- in a) { // push sorted data for a
flag = flag && k1 == (0-a[k1]) // check data for a
foreach (k2- in b) { // push sorted data for b
flag = flag && k2 == b[k2] // check data for b
foreach (k3- in a limit lim) { // bug -- don't push, pop sorted data for
b
flag = 0 // should not be invoked
} // bug -- after popping, will read sorted data for a on next iteration
} // pop sorted data for b, but with bug pops a
} // pop sorted data for a, but with bug pops <nada> -- segfault?
Filing since I suspect a less convoluted set of loops will cause the same
thing.
--
You are receiving this mail because:
You are the assignee for the bug.
next reply other threads:[~2019-07-15 16:51 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-15 16:51 me at serhei dot io [this message]
2019-07-15 17:24 ` [Bug bpf/24811] " me at serhei dot io
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-24811-6586@http.sourceware.org/bugzilla/ \
--to=sourceware-bugzilla@sourceware.org \
--cc=systemtap@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).