Re: [PATCH bpf] bpf: search_bpf_extables should search subprogram extables

[Krister Johansen]

On Mon, Jun 05, 2023 at 04:30:29PM -0700, Alexei Starovoitov wrote:
> On Mon, Jun 5, 2023 at 9:50 AM Krister Johansen <kjlx@xxxxxxxxxxxxxxxxxx> wrote:
> > +                       if (!aux->func[i]->aux->num_exentries ||
> > +                           aux->func[i]->aux->extable == NULL)
> > +                               continue;
> > +                       e = search_extable(aux->func[i]->aux->extable,
> > +                           aux->func[i]->aux->num_exentries, addr);
> > +               }
> > +       }
> 
> something odd here.
> We do bpf_prog_kallsyms_add(func[i]); for each subprog.
> So bpf_prog_ksym_find() in search_bpf_extables()
> should be finding ksym and extable of the subprog
> and not the main prog.
> The bug is probably elsewhere.

I have a kdump (or more) of this bug so if there's additional state
you'd like me to share, let me know.  With your comments in mind, I took
another look at the ksym fields in the aux structs.  I have this in the
main program:

  ksym = {
    start = 18446744072638420852,
    end = 18446744072638423040,
    name = <...>
    lnode = {
      next = 0xffff88d9c1065168,
      prev = 0xffff88da91609168
    },
    tnode = {
      node = {{
          __rb_parent_color = 18446613068361611640,
          rb_right = 0xffff88da91609178,
          rb_left = 0xffff88d9f0c5a578
        }, {
          __rb_parent_color = 18446613068361611664,
          rb_right = 0xffff88da91609190,
          rb_left = 0xffff88d9f0c5a590
        }}
    },
    prog = true
  },

and this in the func[0] subprogram:

  ksym = {
    start = 18446744072638420852,
    end = 18446744072638423040,
    name = <...>
    lnode = {
      next = 0xffff88da91609168,
      prev = 0xffffffff981f8990 <bpf_kallsyms>
    },
    tnode = {
      node = {{
          __rb_parent_color = 18446613068361606520,
          rb_right = 0x0,
          rb_left = 0x0
        }, {
          __rb_parent_color = 18446613068361606544,
          rb_right = 0x0,
          rb_left = 0x0
        }}
    },
    prog = true
  },

That sure looks like func[0] is a leaf in the rbtree and the main
program is an intermediate node with leaves.  If that's the case, then
bpf_prog_ksym_find may have found the main program instead of the
subprogram.  In that case, do you think it's better to skip the main
program's call to bpf_prog_ksym_set_addr() if it has subprograms instead
of searching for subprograms if the main program is found?

-K