Skip to content

Conversation

@kraj
Copy link
Contributor

@kraj kraj commented Nov 5, 2021

Starting 5.15 kernel has mctp.h as well and provides some of the
defintions, therefore move the ones we need to provide in this header
outside the conditional check so its always provided regardless of
header coming from kernel or not.

Include linux/if_link.h so it can pre-define IFLA_MCTP_UNSPEC and other
defines and there is a check for conditionally providing them here but
kernel does not have such a check, so if linux/if_link.h is included
after this header then we end up with duplicate defines

linux/if_link.h:1267:2: error: redefinition of enumerator 'IFLA_MCTP_UNSPEC'
IFLA_MCTP_UNSPEC,
^
../git/src/mctp.h:74:2: note: previous definition is here
IFLA_MCTP_UNSPEC,
^

Signed-off-by: Khem Raj raj.khem@gmail.com

Starting 5.15 kernel has mctp.h as well and provides some of the
defintions, therefore move the ones we need to provide in this header
outside the conditional check so its always provided regardless of
header coming from kernel or not.

Include linux/if_link.h so it can pre-define IFLA_MCTP_UNSPEC and other
defines and there is a check for conditionally providing them here but
kernel does not have such a check, so if linux/if_link.h is included
after this header then we end up with duplicate defines

linux/if_link.h:1267:2: error: redefinition of enumerator 'IFLA_MCTP_UNSPEC'
        IFLA_MCTP_UNSPEC,
        ^
../git/src/mctp.h:74:2: note: previous definition is here
        IFLA_MCTP_UNSPEC,
        ^

Signed-off-by: Khem Raj <raj.khem@gmail.com>
@jk-ozlabs jk-ozlabs merged commit 7888c09 into CodeConstruct:main Nov 16, 2021
@jk-ozlabs
Copy link
Member

Hi Khem,

Thanks for the PR, and for testing against the actual kernel headers! Looks good, merged.

amboar added a commit to amboar/mctp that referenced this pull request Apr 15, 2025
Avoids a heap UAF caught by ASAN:

    ==179005==ERROR: AddressSanitizer: heap-use-after-free on address 0x61f000000c38 at pc 0x55dfaa7fa308 bp 0x7ffe10264420 sp 0x7ffe10264418
    READ of size 8 at 0x61f000000c38 thread T0
        #0 0x55dfaa7fa307 in peer_endpoint_recover ../src/mctpd.c:2570
        CodeConstruct#1 0x7f9a43dadae3  (/lib/x86_64-linux-gnu/libsystemd.so.0+0x78ae3)
        CodeConstruct#2 0x7f9a43dade04 in sd_event_dispatch (/lib/x86_64-linux-gnu/libsystemd.so.0+0x78e04)
        CodeConstruct#3 0x7f9a43daf2e7 in sd_event_run (/lib/x86_64-linux-gnu/libsystemd.so.0+0x7a2e7)
        CodeConstruct#4 0x7f9a43daf506 in sd_event_loop (/lib/x86_64-linux-gnu/libsystemd.so.0+0x7a506)
        CodeConstruct#5 0x55dfaa80a609 in main ../src/mctpd.c:4547
        CodeConstruct#6 0x7f9a42c46249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
        CodeConstruct#7 0x7f9a42c46304 in __libc_start_main_impl ../csu/libc-start.c:360
        CodeConstruct#8 0x55dfaa7e38d0 in _start (mctp/build/test-mctpd+0x688d0)

    0x61f000000c38 is located 3000 bytes inside of 3040-byte region [0x61f000000080,0x61f000000c60)
    freed by thread T0 here:
        #0 0x7f9a436b78d5 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:85
        CodeConstruct#1 0x55dfaa7ef028 in add_peer ../src/mctpd.c:1419
        CodeConstruct#2 0x55dfaa7f1587 in endpoint_assign_eid ../src/mctpd.c:1601
        CodeConstruct#3 0x55dfaa7f55a0 in method_setup_endpoint ../src/mctpd.c:2038
        CodeConstruct#4 0x7f9a43d650ad  (/lib/x86_64-linux-gnu/libsystemd.so.0+0x300ad)

    previously allocated by thread T0 here:
        #0 0x7f9a436b78d5 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:85
        CodeConstruct#1 0x55dfaa7ef028 in add_peer ../src/mctpd.c:1419
        CodeConstruct#2 0x55dfaa805741 in add_local_eid ../src/mctpd.c:4052
        CodeConstruct#3 0x55dfaa80627f in add_interface_local ../src/mctpd.c:4114
        CodeConstruct#4 0x55dfaa806ffa in setup_nets ../src/mctpd.c:4200
        CodeConstruct#5 0x55dfaa80a380 in main ../src/mctpd.c:4525
        CodeConstruct#6 0x7f9a42c46249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    SUMMARY: AddressSanitizer: heap-use-after-free ../src/mctpd.c:2570 in peer_endpoint_recover
    Shadow bytes around the buggy address:
      0x0c3e7fff8130: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x0c3e7fff8140: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x0c3e7fff8150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x0c3e7fff8160: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x0c3e7fff8170: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
    =>0x0c3e7fff8180: fd fd fd fd fd fd fd[fd]fd fd fd fd fa fa fa fa
      0x0c3e7fff8190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c3e7fff81a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c3e7fff81b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c3e7fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c3e7fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
    ==179005==ABORTING

Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
khangng-ampere added a commit to khangng-ampere/mctp that referenced this pull request Jun 2, 2025
pytest-tap 3.5 prints all the captured stdout and stderr into comments
of the TAP output:

    # --- Captured Err ---
    # test-mctpd: log CodeConstruct#1
    # test-mctpd: log CodeConstruct#2
    # test-mctpd: ...

This just improves the situation over having no logs at all, or having
to rerun with pytest directly to see the log.

Signed-off-by: Khang D Nguyen <khangng@os.amperecomputing.com>
faizana-nvidia pushed a commit to faizana-nvidia/mctp-bridge-support that referenced this pull request Jul 2, 2025
pytest-tap 3.5 prints all the captured stdout and stderr into comments
of the TAP output:

    # --- Captured Err ---
    # test-mctpd: log CodeConstruct#1
    # test-mctpd: log CodeConstruct#2
    # test-mctpd: ...

This just improves the situation over having no logs at all, or having
to rerun with pytest directly to see the log.

Signed-off-by: Khang D Nguyen <khangng@os.amperecomputing.com>
amboar added a commit to amboar/mctp that referenced this pull request Nov 28, 2025
Mitigate the following ubsan splat:

    Feb 27 09:32:23 test mctpd[1034]: ../git/src/mctp-netlink.c:960:3: runtime error: null pointer passed as argument 1, which is declared to never be null
    Feb 27 09:32:23 test mctpd[1034]:     #0 0x4552c4  (/usr/sbin/mctpd+0x4a2c4) (BuildId: 0a2c71201a0ddde8f9bbe7d2fd65628c4e08f5d8)
    Feb 27 09:32:23 test mctpd[1034]:     CodeConstruct#1 0x42c3b0  (/usr/sbin/mctpd+0x213b0) (BuildId: 0a2c71201a0ddde8f9bbe7d2fd65628c4e08f5d8)
    Feb 27 09:32:23 test mctpd[1034]:     CodeConstruct#2 0xa623b4ac  (/usr/lib/libc.so.6+0x1f4ac) (BuildId: f7dfc12cfaed3ca290b3c7f41ef9145c0de0fe6b)
    Feb 27 09:32:23 test mctpd[1034]:     CodeConstruct#3 0xa623b598 in __libc_start_main (/usr/lib/libc.so.6+0x1f598) (BuildId: f7dfc12cfaed3ca290b3c7f41ef9145c0de0fe6b)

glibc (e.g. 2.41) declares qsort as:

    extern void qsort (void *__base, size_t __nmemb, size_t __size,
    		   __compar_fn_t __compar) __nonnull ((1, 4));

Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
amboar added a commit to amboar/mctp that referenced this pull request Nov 28, 2025
Mitigate the ubsan splat:

    Feb 27 09:30:55 test mctpd[984]: SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../../../../../workspace/sources/mctp/src/mctp-netlink.c:1102:2 in
    Feb 27 09:31:00 test mctpd[993]: ../../../../../../workspace/sources/mctp/src/mctp-netlink.c:1102:2: runtime error: null pointer passed as argument 2, which is declared to never be null
    Feb 27 09:31:00 test mctpd[993]:     #0 0x47fcc0  (/usr/sbin/mctpd+0x57cc0) (BuildId: 74658a0b3317f1295bab6bbcd8febf809768bfda)
    Feb 27 09:31:00 test mctpd[993]:     CodeConstruct#1 0x459590  (/usr/sbin/mctpd+0x31590) (BuildId: 74658a0b3317f1295bab6bbcd8febf809768bfda)
    Feb 27 09:31:00 test mctpd[993]:     CodeConstruct#2 0x4498f0  (/usr/sbin/mctpd+0x218f0) (BuildId: 74658a0b3317f1295bab6bbcd8febf809768bfda)
    Feb 27 09:31:00 test mctpd[993]:     CodeConstruct#3 0xa62904ac  (/usr/lib/libc.so.6+0x1f4ac) (BuildId: f7dfc12cfaed3ca290b3c7f41ef9145c0de0fe6b)
    Feb 27 09:31:00 test mctpd[993]:     CodeConstruct#4 0xa6290598 in __libc_start_main (/usr/lib/libc.so.6+0x1f598) (BuildId: f7dfc12cfaed3ca290b3c7f41ef9145c0de0fe6b)

Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
amboar added a commit to amboar/mctp that referenced this pull request Nov 28, 2025
Mitigate the following ubsan splat:

    Feb 27 09:32:23 test mctpd[1034]: ../git/src/mctp-netlink.c:960:3: runtime error: null pointer passed as argument 1, which is declared to never be null
    Feb 27 09:32:23 test mctpd[1034]:     #0 0x4552c4  (/usr/sbin/mctpd+0x4a2c4) (BuildId: 0a2c71201a0ddde8f9bbe7d2fd65628c4e08f5d8)
    Feb 27 09:32:23 test mctpd[1034]:     CodeConstruct#1 0x42c3b0  (/usr/sbin/mctpd+0x213b0) (BuildId: 0a2c71201a0ddde8f9bbe7d2fd65628c4e08f5d8)
    Feb 27 09:32:23 test mctpd[1034]:     CodeConstruct#2 0xa623b4ac  (/usr/lib/libc.so.6+0x1f4ac) (BuildId: f7dfc12cfaed3ca290b3c7f41ef9145c0de0fe6b)
    Feb 27 09:32:23 test mctpd[1034]:     CodeConstruct#3 0xa623b598 in __libc_start_main (/usr/lib/libc.so.6+0x1f598) (BuildId: f7dfc12cfaed3ca290b3c7f41ef9145c0de0fe6b)

glibc (e.g. 2.41) declares qsort as:

    extern void qsort (void *__base, size_t __nmemb, size_t __size,
    		   __compar_fn_t __compar) __nonnull ((1, 4));

Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
amboar added a commit to amboar/mctp that referenced this pull request Nov 28, 2025
Mitigate the ubsan splat:

    Feb 27 09:30:55 test mctpd[984]: SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../../../../../workspace/sources/mctp/src/mctp-netlink.c:1102:2 in
    Feb 27 09:31:00 test mctpd[993]: ../../../../../../workspace/sources/mctp/src/mctp-netlink.c:1102:2: runtime error: null pointer passed as argument 2, which is declared to never be null
    Feb 27 09:31:00 test mctpd[993]:     #0 0x47fcc0  (/usr/sbin/mctpd+0x57cc0) (BuildId: 74658a0b3317f1295bab6bbcd8febf809768bfda)
    Feb 27 09:31:00 test mctpd[993]:     CodeConstruct#1 0x459590  (/usr/sbin/mctpd+0x31590) (BuildId: 74658a0b3317f1295bab6bbcd8febf809768bfda)
    Feb 27 09:31:00 test mctpd[993]:     CodeConstruct#2 0x4498f0  (/usr/sbin/mctpd+0x218f0) (BuildId: 74658a0b3317f1295bab6bbcd8febf809768bfda)
    Feb 27 09:31:00 test mctpd[993]:     CodeConstruct#3 0xa62904ac  (/usr/lib/libc.so.6+0x1f4ac) (BuildId: f7dfc12cfaed3ca290b3c7f41ef9145c0de0fe6b)
    Feb 27 09:31:00 test mctpd[993]:     CodeConstruct#4 0xa6290598 in __libc_start_main (/usr/lib/libc.so.6+0x1f598) (BuildId: f7dfc12cfaed3ca290b3c7f41ef9145c0de0fe6b)

Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants