R1 min value is outside of the allowed memory range

[vimalk78]

I have a bpf program in which i need to match string prefix. the prefix is fixed, so i wrote following function

#define VAR_LOG_PODS "/var/log/pods"
const char LOG_DIR[sizeof(VAR_LOG_PODS) + 1] = VAR_LOG_PODS;
#define LEN_LOG_DIR sizeof(LOG_DIR)

SEC("tracepoint/syscalls/sys_enter_openat")
int syscall_enter_open(struct syscall_enter_openat_args_t *args) {
  char filename[MAX_FILE_NAME_LENGTH];    
  bpf_probe_read_user_str(filename, sizeof(filename), args->filename);    
  if (matchPrefix(filename) != 0) {    
    return 0;    
  }  

 // do  other things
}

int matchPrefix(const char str[MAX_FILE_NAME_LENGTH]) {
  if (str == NULL) {
    return -100;
  }
  for (int i = 0; i < LEN_LOG_DIR; i++) {
    const char ch1 = LOG_DIR[i];
    if (ch1 == '\0') {
      return 0;
    }
    const char ch2 = str[i];
    if (ch2 == '\0') {
      return -1;
    }
    if (ch1 != ch2) {
      return -2;
    }
  }
  return (-3);
}

when i load this, i get below error

libbpf: -- BEGIN DUMP LOG ---
libbpf: 
Validating matchPrefix() func#1...
38: R1=mem_or_null(id=2,off=0,imm=0) R10=fp0
; int matchPrefix(const char str[MAX_FILE_NAME_LENGTH]) {
38: (18) r0 = 0xffffff9c              ; R0_w=P4294967196
; if (str == NULL) {
40: (15) if r1 == 0x0 goto pc+10      ; R1=mem(off=0,imm=0)
41: (18) r0 = 0xffffffff              ; R0_w=P4294967295
; const char ch2 = str[i];
43: (71) r2 = *(u8 *)(r1 +0)          ; R1=mem(off=0,imm=0) R2_w=Pscalar(umax=255,var_off=(0x0; 0xff))
; if (ch2 == '\0') {
44: (15) if r2 == 0x0 goto pc+6       ; R2_w=Pscalar(umax=255,var_off=(0x0; 0xff))
45: (55) if r2 != 0x2f goto pc+3      ; R2_w=P47
; const char ch2 = str[i];
46: (71) r2 = *(u8 *)(r1 +1)
invalid access to memory, mem_size=1 off=1 size=1
R1 min value is outside of the allowed memory range
processed 7 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

libbpf: -- END LOG --

Can you help me to fix it?

Note: I also tried to use bpf_strncmp function, but that errors out with R3 type=fp expected=map_value. i can provide details if required.

[vimalk78]

i see from bpf verifier code for kernel version 5.19.16
https://elixir.bootlin.com/linux/v5.19.16/source/kernel/bpf/verifier.c#L3524
that the condition check is

     if (off >= 0 && size_ok && (u64)off + size <= mem_size)
         return 0;

and from above libbpf error output we can see that mem_size=1 off=1 size=1 so condition evaluates to false.
from the code,

   const char ch2 = str[i]

when i is 1, i can understand the meaning of off and size, but i dont understand the meaning of mem_size and why it is 1 ?

[yonghong-song]

You need to check the return value of bpf_probe_read_user_str(). The return value indicates the length of the output string.
If it is negative value, something wrong.

[chenhengqi]

You may use BPF_MAP_TYPE_LPM_TRIE.