Re: [PATCH bpf-next 05/13] libbpf: Add tracing_multi link support for bpf progs

On 9/8/26 23:21, [email protected] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Missing input validation in `bpf_program__attach_tracing_multi` leads to a potential segmentation fault when a user-provided array element is NULL.
> --
> 
> --- Patch [5]: [PATCH bpf-next 05/13] libbpf: Add tracing_multi link support for bpf progs ---
> commit bef5c103ea1916738efc32c272265795c04de90a
> Author: Leon Hwang <[email protected]>
> 
> libbpf: Add tracing_multi link support for bpf progs
> 
> This commit introduces tracing_multi link support for bpf programs in libbpf.
> It adds fds and funcs fields to bpf_tracing_multi_opts to specify target
> programs, translating the function names to BTF IDs before passing them to
> the kernel.
> 
>> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
>> index 514e4e9daa825..d698a64ff8002 100644
>> --- a/tools/lib/bpf/libbpf.c
>> +++ b/tools/lib/bpf/libbpf.c
> [ ... ]
>> @@ -12720,11 +12732,28 @@ bpf_program__attach_tracing_multi(const struct bpf_program *prog, const char *pa
>>  		if (cnt == 0)
>>  			return libbpf_err_ptr(-EINVAL);
>>  		ids = (const __u32 *) free_ids;
>> +	} else if (fds) {
>> +		size_t cap = 0;
>> +		int i;
>> +
>> +		err = libbpf_ensure_mem((void **) &free_ids, &cap, sizeof(*free_ids), cnt);
>> +		if (err)
>> +			return libbpf_err_ptr(err);
>> +
>> +		for (i = 0; i < cnt; i++) {
>> +			err = libbpf_find_prog_btf_id(funcs[i], fds[i], prog->obj->token_fd);
> 
> [Severity: Medium]
> Could funcs[i] be NULL here if the user-space application provided an invalid
> string pointer in the array?
> 
> If it is NULL, this pointer gets passed down through libbpf_find_prog_btf_id()
> and eventually reaches btf_find_by_name_kind(), which performs this check:
> 
> tools/lib/bpf/btf.c:btf_find_by_name_kind() {
>     ...
>     if (kind == BTF_KIND_UNKN || strcmp(type_name, "void") == 0)
>     ...
> }
> 
> Calling strcmp() with a NULL type_name will cause a segmentation fault in
> the application. Is it worth validating that funcs[i] is not NULL to safely
> return an error code instead of crashing?
> 

Will check '!funcs[i]' before libbpf_find_prog_btf_id().

Thanks,
Leon

>> +			if (err < 0)
>> +				goto error;
>> +
>> +			free_ids[i] = err;
>> +		}
>> +		ids = (const __u32 *) free_ids;
>>  	}
>