microsoft / microsoft/SysinternalsEBPF

Build errors concerning discoverOffsets.c

Open
#7 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
C
Stars
288
Forks
38
Avg merge
21d 13h
Merged PRs (30d)
1

Description

Trying to build SysinternalseBPF I get the following errors:

[ 21%] Building C object CMakeFiles/sysinternalsEBPF.dir/discoverOffsets.c.o
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘memDumpEventCb’:
/path/to/SysinternalsEBPF/discoverOffsets.c:141:29: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast]
         memAddrs[d->type] = (uint64_t)d->addr;
                             ^
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘isPointer’:
/path/to/SysinternalsEBPF/discoverOffsets.c:77:30: error: left shift count >= width of type [-Werror=shift-count-overflow]
 #define MAX_POINTER_DIFF (1L << 36)
                              ^~
/path/to/SysinternalsEBPF/discoverOffsets.c:175:38: note: in expansion of macro ‘MAX_POINTER_DIFF’
     if (labs(ptr - memAddrs[task]) < MAX_POINTER_DIFF) {
                                      ^~~~~~~~~~~~~~~~
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘searchPtr’:
/path/to/SysinternalsEBPF/discoverOffsets.c:77:30: error: left shift count >= width of type [-Werror=shift-count-overflow]
 #define MAX_POINTER_DIFF (1L << 36)
                              ^~
/path/to/SysinternalsEBPF/discoverOffsets.c:432:79: note: in expansion of macro ‘MAX_POINTER_DIFF’
     return searchUint64(out, dir, type, startOffset, numElem, memAddrs[task], MAX_POINTER_DIFF);
                                                                               ^~~~~~~~~~~~~~~~
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘searchDerefUint32’:
/path/to/SysinternalsEBPF/discoverOffsets.c:619:29: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
         if (!dumpStruct(to, (void *)get64(from, off[0]), DUMP_SIZE, pb)) {
                             ^
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘getCredsOffsets’:
/path/to/SysinternalsEBPF/discoverOffsets.c:848:36: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
     if (!setConfigPid(child, cred, (void *)get64(task, offsets->cred[0]), DUMP_SIZE)) {
                                    ^
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘getPwdPathOffset’:
/path/to/SysinternalsEBPF/discoverOffsets.c:927:25: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
     if (!dumpStruct(fs, (void *)get64(task, startOffset), DUMP_SIZE, pb)) {
                         ^
/path/to/SysinternalsEBPF/discoverOffsets.c:945:41: error: format ‘%lx’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘uint64_t’ {aka ‘long long unsigned int’} [-Werror=format=]
             fprintf(stderr, "0 = 0x%016lx\n", get64(fs, offsets->pwd_path[1]));
                                    ~~~~~^     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                    %016llx
/path/to/SysinternalsEBPF/discoverOffsets.c:946:41: error: format ‘%lx’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘uint64_t’ {aka ‘long long unsigned int’} [-Werror=format=]
             fprintf(stderr, "1 = 0x%016lx\n", get64(fs, offsets->pwd_path[1] + sizeof(uint64_t)));
                                    ~~~~~^     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                    %016llx
/path/to/SysinternalsEBPF/discoverOffsets.c:947:41: error: format ‘%lx’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘uint64_t’ {aka ‘long long unsigned int’} [-Werror=format=]
             fprintf(stderr, "2 = 0x%016lx\n", get64(fs, offsets->pwd_path[1] + (2 * sizeof(uint64_t))));
                                    ~~~~~^     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                    %016llx
/path/to/SysinternalsEBPF/discoverOffsets.c:948:41: error: format ‘%lx’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘uint64_t’ {aka ‘long long unsigned int’} [-Werror=format=]
             fprintf(stderr, "3 = 0x%016lx\n", get64(fs, offsets->pwd_path[1] + (3 * sizeof(uint64_t))));
                                    ~~~~~^     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                    %016llx
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘getDentryNameOffset’:
/path/to/SysinternalsEBPF/discoverOffsets.c:981:29: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
     if (!dumpStruct(dentry, (void *)get64(fs, offsets->pwd_path[1] + offsets->path_dentry[0]), DUMP_SIZE, pb)) {
                             ^
/path/to/SysinternalsEBPF/discoverOffsets.c:1000:34: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
             if (!dumpStruct(pwd, (void *)get64(dentry, offsets->dentry_name[0]), DUMP_SIZE, pb)) {
                                  ^
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘getDentryInodeOffsets’:
/path/to/SysinternalsEBPF/discoverOffsets.c:1078:28: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
     if (!dumpStruct(inode, (void *)get64(dentry, offsets->dentry_inode[0]), DUMP_SIZE, pb)) {
                            ^
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘getMountOffsets’:
/path/to/SysinternalsEBPF/discoverOffsets.c:1162:28: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
     if (!dumpStruct(mount, (void *)get64(fs, offsets->pwd_path[1] + offsets->path_vfsmount[0]) - 512,
                            ^
/path/to/SysinternalsEBPF/discoverOffsets.c:1176:39: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
     if (!dumpStruct(dentryMountpoint, (void *)get64(mount, offsets->mount_mountpoint[0]), DUMP_SIZE, pb)) {
                                       ^
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘getFdOffsets’:
/path/to/SysinternalsEBPF/discoverOffsets.c:1239:28: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
     if (!dumpStruct(files, (void *)get64(task, offsets->max_fds[0]), DUMP_SIZE, pb)) {
                            ^
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘getTtyOffset’:
/path/to/SysinternalsEBPF/discoverOffsets.c:1321:30: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
     if (!dumpStruct(signals, (void *)get64(task, offsets->tty[0]), DUMP_SIZE, pb)) {
                              ^
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘getMmOffsets’:
/path/to/SysinternalsEBPF/discoverOffsets.c:1477:25: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
     if (!dumpStruct(mm, (void *)get64(task, offsets->mm_arg_start[0]), DUMP_SIZE, pb)) {
                         ^
/path/to/SysinternalsEBPF/discoverOffsets.c:1483:71: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast]
     if (searchUint64(&offsets->mm_arg_start[1], forwards, mm, 0, 128, (uint64_t)argv[0], 0)) {
                                                                       ^
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘getExePathOffset’:
/path/to/SysinternalsEBPF/discoverOffsets.c:1573:42: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
                 if (!dumpStruct(exeFile, (void *)get64(mm, startOffset), DUMP_SIZE, pb)) {
                                          ^
/path/to/SysinternalsEBPF/discoverOffsets.c:1579:48: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
                     if (!dumpStruct(exeDentry, (void *)dentry, DUMP_SIZE, pb)) {
                                                ^
/path/to/SysinternalsEBPF/discoverOffsets.c:1584:46: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
                     if (!dumpStruct(exeName, (void *)exe_dname, DUMP_SIZE, pb)) {
                                              ^
/path/to/SysinternalsEBPF/discoverOffsets.c: In function ‘getSkbOffsets’:
/path/to/SysinternalsEBPF/discoverOffsets.c:77:30: error: left shift count >= width of type [-Werror=shift-count-overflow]
 #define MAX_POINTER_DIFF (1L << 36)
                              ^~
/path/to/SysinternalsEBPF/discoverOffsets.c:1663:39: note: in expansion of macro ‘MAX_POINTER_DIFF’
         if (near(addr, memAddrs[skb], MAX_POINTER_DIFF)) {
                                       ^~~~~~~~~~~~~~~~
/path/to/SysinternalsEBPF/discoverOffsets.c:1664:31: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
             setConfig(skdata, (const void *)(uint64_t)startOffset, 36);
                               ^
cc1: all warnings being treated as errors
make[2]: *** [CMakeFiles/sysinternalsEBPF.dir/build.make:91: CMakeFiles/sysinternalsEBPF.dir/discoverOffsets.c.o] error 1
make[1]: *** [CMakeFiles/Makefile2:73: CMakeFiles/sysinternalsEBPF.dir/all] error 2
make: *** [Makefile:130: all] error 2

Guessing it has to do with autodiscovery of offsets https://github.com/Sysinternals/SysinternalsEBPF#autodiscovery-of-offsets I already built the sysinternalsEBPF_offsets.conf file as described in the README of getOffsets via make conf to /path/to/sysinternalsEBPF/sysinternalsEBPF_offsets.conf. It seems to me that the file is ignored in subsequent builds though?

OS
Debian 10 Buster

Kernel
5.10.60 on armhf

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with discoverOffsets.c and the CMake build output, focusing on the pointer casts, MAX_POINTER_DIFF, and format warnings reported on armhf. Then read the getOffsets README and inspect how make conf creates and how subsequent builds consume sysinternalsEBPF_offsets.conf. Done means the project builds successfully on Debian 10 armhf with the generated offsets configuration applied.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, cmake, linux
Domain
build-system, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.