Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@jsitnicki
Copy link

Please see the individual commits for the description of errors encountered when trying to use unixdump on Linux 5.10.

When starting unixdump, BPF verifier complains about invalid read from
stack:

  177: (85) call bpf_perf_event_output#25
  invalid indirect read from stack off -208+35 size 208

This is because struct notify_t object that we allocate on stack might not
be initialized. See similar issue description at:

iovisor/bcc#2623 (comment)

Zero the data allocated on stack that we pass to bpf_perf_event_output().

Observed with:
 - linux 5.10.14
 - bcc 0.18.0
When starting unixdump, BPF verifier complains about unbounded access:

  739: (85) call bpf_probe_read#4
  …
  R2 unbounded memory access, use 'var &= const' or 'if (var < const)'

Follow the verifier suggestion, and add a redundant check for the upper
bound of the offset passed to bpf_probe_read().

Observed with:
 - linux 5.10.18
 - bcc 0.16.17
@kroemeke
Copy link

I think the memset one is now done through "notify_memset" added in 7ebb858 .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants