UBSAN: function pointer casting in `dt_htab`
Open
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 189
- Forks
- 23
- PR merge metrics
- No merged PRs in 30d
Description
With Clang's UBSAN:
$ export UBSAN_OPTIONS="print_stacktrace=1:halt_on_error=0"
$ make CC=clang CFLAGS="-O2 -fsanitize=undefined -static-libsan -ggdb3" LDFLAGS="-fsanitize=undefined -static-libsan" verbose=yes -j32 -k
[...]
clang -O2 -fsanitize=undefined -static-libsan -ggdb3 -std=gnu99 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_DT_VERSION=\"2.0.1\" -Iuts/common -fsanitize=undefined -static-libsan -o /home/sam/git/dtrace-utils-bad/build/usdt-tst-argmap /home/sam/git/dtrace-utils-bad/build/test-triggers--usdt-tst-argmap.o /home/sam/git/dtrace-utils-bad/build/test-triggers--usdt-tst-argmap-prov.o -L/home/sam/git/dtrace-utils-bad/build
rm -f test/triggers/usdt-tst-argmap
ln -s /home/sam/git/dtrace-utils-bad/build/usdt-tst-argmap test/triggers/usdt-tst-argmap
libdtrace/dt_htab.c:238:18: runtime error: call to function prv_hval through pointer to incorrect function type 'unsigned int (*)(const void *)'
/home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:54:1: note: prv_hval defined here
#0 0x7fc4f086a4ab in dt_htab_delete /home/sam/git/dtrace-utils-bad/libdtrace/dt_htab.c:238:18
#1 0x7fc4f0910dcb in dt_probe_destroy /home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:354:3
#2 0x7fc4f091c81e in dt_probe_fini /home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:1334:3
#3 0x7fc4f08bab46 in dtrace_close /home/sam/git/dtrace-utils-bad/libdtrace/dt_open.c:1313:2
#4 0x55caac25000e in main /home/sam/git/dtrace-utils-bad/cmd/dtrace.c
#5 0x7fc4f0389834 (/usr/lib64/libc.so.6+0x26834)
#6 0x7fc4f03898e7 in __libc_start_main (/usr/lib64/libc.so.6+0x268e7)
#7 0x55caac221ef4 in _start (/home/sam/git/dtrace-utils-bad/build/dtrace+0xcef4)
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libdtrace/dt_htab.c:238:18
libdtrace/dt_htab.c:248:7: runtime error: call to function prv_cmp through pointer to incorrect function type 'int (*)(const void *, const void *)'
/home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:54:1: note: prv_cmp defined here
#0 0x7fc4f086a2cf in dt_htab_delete /home/sam/git/dtrace-utils-bad/libdtrace/dt_htab.c:248:7
#1 0x7fc4f0910dcb in dt_probe_destroy /home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:354:3
#2 0x7fc4f091c81e in dt_probe_fini /home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:1334:3
#3 0x7fc4f08bab46 in dtrace_close /home/sam/git/dtrace-utils-bad/libdtrace/dt_open.c:1313:2
#4 0x55caac25000e in main /home/sam/git/dtrace-utils-bad/cmd/dtrace.c
#5 0x7fc4f0389834 (/usr/lib64/libc.so.6+0x26834)
#6 0x7fc4f03898e7 in __libc_start_main (/usr/lib64/libc.so.6+0x268e7)
#7 0x55caac221ef4 in _start (/home/sam/git/dtrace-utils-bad/build/dtrace+0xcef4)
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libdtrace/dt_htab.c:248:7
libdtrace/dt_htab.c:258:9: runtime error: call to function prv_del through pointer to incorrect function type 'void *(*)(void *, void *)'
/home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:54:1: note: prv_del defined here
#0 0x7fc4f086a81a in dt_htab_delete /home/sam/git/dtrace-utils-bad/libdtrace/dt_htab.c:258:9
#1 0x7fc4f0910dcb in dt_probe_destroy /home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:354:3
#2 0x7fc4f091c81e in dt_probe_fini /home/sam/git/dtrace-utils-bad/libdtrace/dt_probe.c:1334:3
#3 0x7fc4f08bab46 in dtrace_close /home/sam/git/dtrace-utils-bad/libdtrace/dt_open.c:1313:2
#4 0x55caac25000e in main /home/sam/git/dtrace-utils-bad/cmd/dtrace.c
#5 0x7fc4f0389834 (/usr/lib64/libc.so.6+0x26834)
#6 0x7fc4f03898e7 in __libc_start_main (/usr/lib64/libc.so.6+0x268e7)
#7 0x55caac221ef4 in _start (/home/sam/git/dtrace-utils-bad/build/dtrace+0xcef4)
See https://maskray.me/blog/2022-12-18-control-flow-integrity#fsanitizefunction. Note that GCC's UBSAN doesn't yet include this. This is less important than the other sanitizer issues as I don't think CFI is really a priority for DTrace.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the report with the Clang UBSAN make command, then inspect callback use in libdtrace/dt_htab.c around lines 238-258 and the callback definitions in libdtrace/dt_probe.c at line 54. Confirm the incorrect function-type diagnostics are addressed and rerun the sanitizer build and affected test triggers without those reports.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- observability-sre
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100