oracle / oracle/dtrace

UBSAN: function pointer casting in `dt_htab`

Open
#89 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
189
Forks
23
PR merge metrics
No merged PRs in 30d

Description

With Clang's UBSAN:

$ export UBSAN_OPTIONS="print_stacktrace=1:halt_on_error=0"
$ make CC=clang CFLAGS="-O2 -fsanitize=undefined -static-libsan -ggdb3" LDFLAGS="-fsanitize=undefined -static-libsan" verbose=yes -j32 -k
[...]
clang -O2 -fsanitize=undefined -static-libsan -ggdb3 -std=gnu99 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_DT_VERSION=\"2.0.1\" -Iuts/common -fsanitize=undefined -static-libsan -o /home/sam/git/dtrace-utils-bad/build/usdt-tst-argmap /home/sam/git/dtrace-utils-bad/build/test-triggers--usdt-tst-argmap.o /home/sam/git/dtrace-utils-bad/build/test-triggers--usdt-tst-argmap-prov.o -L/home/sam/git/dtrace-utils-bad/build
rm -f test/triggers/usdt-tst-argmap
ln -s /home/sam/git/dtrace-utils-bad/build/usdt-tst-argmap test/triggers/usdt-tst-argmap
libdtrace/dt_htab.c:238:18: runtime error: call to function prv_hval through pointer to incorrect function type 'unsigned int (*)(const void *)'
/home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:54:1: note: prv_hval defined here
    #0 0x7fc4f086a4ab in dt_htab_delete /home/sam/git/dtrace-utils-bad/libdtrace/dt_htab.c:238:18
    #1 0x7fc4f0910dcb in dt_probe_destroy /home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:354:3
    #2 0x7fc4f091c81e in dt_probe_fini /home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:1334:3
    #3 0x7fc4f08bab46 in dtrace_close /home/sam/git/dtrace-utils-bad/libdtrace/dt_open.c:1313:2
    #4 0x55caac25000e in main /home/sam/git/dtrace-utils-bad/cmd/dtrace.c
    #5 0x7fc4f0389834  (/usr/lib64/libc.so.6+0x26834)
    #6 0x7fc4f03898e7 in __libc_start_main (/usr/lib64/libc.so.6+0x268e7)
    #7 0x55caac221ef4 in _start (/home/sam/git/dtrace-utils-bad/build/dtrace+0xcef4)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libdtrace/dt_htab.c:238:18
libdtrace/dt_htab.c:248:7: runtime error: call to function prv_cmp through pointer to incorrect function type 'int (*)(const void *, const void *)'
/home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:54:1: note: prv_cmp defined here
    #0 0x7fc4f086a2cf in dt_htab_delete /home/sam/git/dtrace-utils-bad/libdtrace/dt_htab.c:248:7
    #1 0x7fc4f0910dcb in dt_probe_destroy /home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:354:3
    #2 0x7fc4f091c81e in dt_probe_fini /home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:1334:3
    #3 0x7fc4f08bab46 in dtrace_close /home/sam/git/dtrace-utils-bad/libdtrace/dt_open.c:1313:2
    #4 0x55caac25000e in main /home/sam/git/dtrace-utils-bad/cmd/dtrace.c
    #5 0x7fc4f0389834  (/usr/lib64/libc.so.6+0x26834)
    #6 0x7fc4f03898e7 in __libc_start_main (/usr/lib64/libc.so.6+0x268e7)
    #7 0x55caac221ef4 in _start (/home/sam/git/dtrace-utils-bad/build/dtrace+0xcef4)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libdtrace/dt_htab.c:248:7
libdtrace/dt_htab.c:258:9: runtime error: call to function prv_del through pointer to incorrect function type 'void *(*)(void *, void *)'
/home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:54:1: note: prv_del defined here
    #0 0x7fc4f086a81a in dt_htab_delete /home/sam/git/dtrace-utils-bad/libdtrace/dt_htab.c:258:9
    #1 0x7fc4f0910dcb in dt_probe_destroy /home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:354:3
    #2 0x7fc4f091c81e in dt_probe_fini /home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:1334:3
    #3 0x7fc4f08bab46 in dtrace_close /home/sam/git/dtrace-utils-bad/libdtrace/dt_open.c:1313:2
    #4 0x55caac25000e in main /home/sam/git/dtrace-utils-bad/cmd/dtrace.c
    #5 0x7fc4f0389834  (/usr/lib64/libc.so.6+0x26834)
    #6 0x7fc4f03898e7 in __libc_start_main (/usr/lib64/libc.so.6+0x268e7)
    #7 0x55caac221ef4 in _start (/home/sam/git/dtrace-utils-bad/build/dtrace+0xcef4)

See https://maskray.me/blog/2022-12-18-control-flow-integrity#fsanitizefunction. Note that GCC's UBSAN doesn't yet include this. This is less important than the other sanitizer issues as I don't think CFI is really a priority for DTrace.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the report with the Clang UBSAN make command, then inspect callback use in libdtrace/dt_htab.c around lines 238-258 and the callback definitions in libdtrace/dt_probe.c at line 54. Confirm the incorrect function-type diagnostics are addressed and rerun the sanitizer build and affected test triggers without those reports.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
observability-sre
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.