Skip to content

fix(run-queue): guard detach against NULL obj in cleanup path - #155

Open
yuKing123-king wants to merge 1 commit into
DKapture:mainfrom
yuKing123-king:fix/run-queue-guard-detach-null-obj
Open

yuKing123-king wants to merge 1 commit into
DKapture:mainfrom
yuKing123-king:fix/run-queue-guard-detach-null-obj

Conversation

@yuKing123-king

Copy link
Copy Markdown
Contributor

修复的 Bug

run-queue 在 BPF 加载失败时,cleanup 路径会对 NULL 指针解引用,导致 SIGSEGV 崩溃。

触发路径:

main()
  → obj = run_queue_bpf::open_and_load();   // 返回 NULL
  → if (!obj) goto cleanup;                 // obj == NULL
  → cleanup:
      run_queue_bpf::detach(obj);           // obj->skeleton 解引用 NULL → SIGSEGV

open_and_load 返回 NULL 是现实可触发的:非 root 运行、内核版本不支持该 BPF 程序、内存不足(calloc 失败)。用户在非特权或低内存场景运行 run-queue,BPF 加载失败后本应清理退出,却在 detach(NULL) 处崩溃。

为什么这样修复

  1. 根因是 libbpf skeleton 生成代码的不对称缺陷:经核实 build/observe/run-queue.skel.hrun_queue_bpf__destroy()if (!obj) return; 判空(skeleton.h:57-58),但 run_queue_bpf__detach() 无判空,直接 bpf_object__detach_skeleton(obj->skeleton) 解引用(skeleton.h:133)。这是 libbpf 生成代码的固有问题,不应在工具侧"修改 skeleton",而应在调用点(run-queue.cpp 的 cleanup)规避。

  2. 只在工具侧加 if (obj),不改 skeleton.h:skeleton.h 是构建系统自动生成的(bpftool gen skeleton),任何手改都会被下次构建覆盖;正确的修复点在调用方。且 cleanup 段上方对 rb 已有 if (rb) 判空,detach 加判空风格一致,最小改动。

  3. destroy 不加判空run_queue_bpf__destroy() 已自带 if (!obj) return;,对 NULL 调用安全,无需改动,避免冗余。

验证方式

# 修复前:非 root 运行,BPF 加载失败后崩溃
./run-queue
# Segmentation fault (core dumped)

# 修复后:非 root 运行,BPF 加载失败后正常退出
./run-queue
# (正常退出码,无崩溃)

Signed-off-by: Wang Yu <wangyu6@uniontech.com>
@github-actions

Copy link
Copy Markdown

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪
🧪 No relevant tests
🔒 No security concerns identified
⚡ No major issues detected

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant