Re: [PATCH bpf-next 05/13] libbpf: Add tracing_multi link support for bpf progs

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing input validation in `bpf_program__attach_tracing_multi` leads to a potential segmentation fault when a user-provided array element is NULL.
--

--- Patch [5]: [PATCH bpf-next 05/13] libbpf: Add tracing_multi link support for bpf progs ---
commit bef5c103ea1916738efc32c272265795c04de90a
Author: Leon Hwang <[email protected]>

libbpf: Add tracing_multi link support for bpf progs

This commit introduces tracing_multi link support for bpf programs in libbpf.
It adds fds and funcs fields to bpf_tracing_multi_opts to specify target
programs, translating the function names to BTF IDs before passing them to
the kernel.

> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 514e4e9daa825..d698a64ff8002 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
[ ... ]
> @@ -12720,11 +12732,28 @@ bpf_program__attach_tracing_multi(const struct bpf_program *prog, const char *pa
>  		if (cnt == 0)
>  			return libbpf_err_ptr(-EINVAL);
>  		ids = (const __u32 *) free_ids;
> +	} else if (fds) {
> +		size_t cap = 0;
> +		int i;
> +
> +		err = libbpf_ensure_mem((void **) &free_ids, &cap, sizeof(*free_ids), cnt);
> +		if (err)
> +			return libbpf_err_ptr(err);
> +
> +		for (i = 0; i < cnt; i++) {
> +			err = libbpf_find_prog_btf_id(funcs[i], fds[i], prog->obj->token_fd);

[Severity: Medium]
Could funcs[i] be NULL here if the user-space application provided an invalid
string pointer in the array?

If it is NULL, this pointer gets passed down through libbpf_find_prog_btf_id()
and eventually reaches btf_find_by_name_kind(), which performs this check:

tools/lib/bpf/btf.c:btf_find_by_name_kind() {
    ...
    if (kind == BTF_KIND_UNKN || strcmp(type_name, "void") == 0)
    ...
}

Calling strcmp() with a NULL type_name will cause a segmentation fault in
the application. Is it worth validating that funcs[i] is not NULL to safely
return an error code instead of crashing?

> +			if (err < 0)
> +				goto error;
> +
> +			free_ids[i] = err;
> +		}
> +		ids = (const __u32 *) free_ids;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=5