Em Fri, May 28, 2021 at 12:48:56PM +0200, Thomas Richter escreveu:
> I noticed perf test 40.1 dumps core on 5.13.0rc2 and rc3:
>
> [root@f34 perf]# ./perf test -F 40
> 40: LLVM search and compile :
> 40.1: Basic BPF llvm compile :
> libbpf: elf: skipping unrecognized data section(8) .eh_frame
> libbpf: elf: skipping relo section(9) .rel.eh_frame for section(8) .eh_frame
> Segmentation fault (core dumped)
> [root@f34 perf]#
> The root cause is a NULL pointer reference in function btf__get_nr_types()
> as can be seen with gdb:
This looks like a bug in libbpf:
static int bpf_object__collect_externs(struct bpf_object *obj)
{
struct btf_type *sec, *kcfg_sec = NULL, *ksym_sec = NULL;
const struct btf_type *t;
struct extern_desc *ext;
int i, n, off, dummy_var_btf_id;
const char *ext_name, *sec_name;
Elf_Scn *scn;
GElf_Shdr sh;
if (!obj->efile.symbols)
return 0;
scn = elf_sec_by_idx(obj, obj->efile.symbols_shndx);
if (elf_sec_hdr(obj, scn, &sh))
return -LIBBPF_ERRNO__FORMAT;
dummy_var_btf_id = add_dummy_ksym_var(obj->btf);
if (dummy_var_btf_id < 0)
return dummy_var_btf_id;
obj->btf is NULL, so probably btf__find_by_name_kind() should check that
and return an error, Andrii?
- Arnaldo
> Breakpoint 1, 0x000000000065f4b1 in btf__get_nr_types
> (btf=btf@entry=0x0) at btf.c:425
> 425 return btf->start_id + btf->nr_types - 1;
>
> This is the same function and reason why test case 42.1 Basic BPF filtering
> fails and dumps core too.
>
> The call chain is:
> (gdb) where
> #0 0x000000000065f4b1 in btf__get_nr_types (btf=btf@entry=0x0) at btf.c:425
> #1 btf__find_by_name_kind (btf=btf@entry=0x0,
> type_name=type_name@entry=0x928ab2 ".ksyms",
> kind=kind@entry=15) at btf.c:696
> #2 0x00000000006527fe in add_dummy_ksym_var (btf=0x0) at libbpf.c:3219
> #3 bpf_object__collect_externs (obj=0xd0ea20) at libbpf.c:3266
> #4 __bpf_object__open (path=<optimized out>, path@entry=0x0,
> obj_buf=obj_buf@entry=0xd12fa0,
> obj_buf_sz=obj_buf_sz@entry=1520,
> opts=opts@entry=0x7fffffffdb30) at libbpf.c:7372
> #5 0x0000000000655415 in __bpf_object__open (opts=0x7fffffffdb30,
> obj_buf_sz=1520, obj_buf=0xd12fa0, path=0x0) at libbpf.c:7337
> #6 bpf_object__open_mem (opts=0x7fffffffdb30, obj_buf_sz=1520,
> obj_buf=0xd12fa0) at libbpf.c:7454
> #7 bpf_object__open_mem (opts=0x7fffffffdb30, obj_buf_sz=1520,
> obj_buf=0xd12fa0) at libbpf.c:7448
> #8 bpf_object__open_buffer (obj_buf=0xd12fa0, obj_buf_sz=1520,
> name=<optimized out>) at libbpf.c:7471
> #9 0x00000000004c8c6e in test__bpf_parsing (obj_buf=0xd12fa0,
> obj_buf_sz=1520) at tests/llvm.c:16
> #10 0x00000000004c8fe2 in test__llvm (test=0xac7d20 <generic_tests+2496>,
> subtest=0) at tests/llvm.c:142
> ...
>
> I have no knowledge about BPF and why the core dump happens. Before
> I start digging into this has anybody some hints on where to look?
>
> Thanks a lot.
>
> --
> Thomas Richter, Dept 3303, IBM s390 Linux Development, Boeblingen, Germany
> --
> Vorsitzender des Aufsichtsrats: Gregor Pillen
> Geschäftsführung: Dirk Wittkopp
> Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294
--
- Arnaldo
