* [PATCH 3/4] tools: bpftool: fix potential NULL pointer dereference in do_load
@ 2018-11-21 7:43 Wen Yang
2018-11-21 16:58 ` Jakub Kicinski
2018-11-21 17:18 ` Y Song
0 siblings, 2 replies; 5+ messages in thread
From: Wen Yang @ 2018-11-21 7:43 UTC (permalink / raw)
To: ast
Cc: daniel, jakub.kicinski, quentin.monnet, jiong.wang, guro,
sandipan, john.fastabend, netdev, linux-kernel, zhong.weidong,
wang.yi59, Wen Yang, Julia Lawall
This patch fixes a possible null pointer dereference in
do_load, detected by the semantic patch
deref_null.cocci, with the following warning:
./tools/bpf/bpftool/prog.c:1021:23-25: ERROR: map_replace is NULL but dereferenced.
The following code has potential null pointer references:
881 map_replace = reallocarray(map_replace, old_map_fds + 1,
882 sizeof(*map_replace));
883 if (!map_replace) {
884 p_err("mem alloc failed");
885 goto err_free_reuse_maps;
886 }
...
1019 err_free_reuse_maps:
1020 for (i = 0; i < old_map_fds; i++)
1021 close(map_replace[i].fd);
1022 free(map_replace);
Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
Reviewed-by: Tan Hu <tan.hu@zte.com.cn>
CC: Julia Lawall <julia.lawall@lip6.fr>
---
tools/bpf/bpftool/prog.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 5302ee2..de42187 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -1017,8 +1017,9 @@ static int do_load(int argc, char **argv)
err_close_obj:
bpf_object__close(obj);
err_free_reuse_maps:
- for (i = 0; i < old_map_fds; i++)
- close(map_replace[i].fd);
+ if (map_replace)
+ for (i = 0; i < old_map_fds; i++)
+ close(map_replace[i].fd);
free(map_replace);
return -1;
}
--
2.9.5
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH 3/4] tools: bpftool: fix potential NULL pointer dereference in do_load 2018-11-21 7:43 [PATCH 3/4] tools: bpftool: fix potential NULL pointer dereference in do_load Wen Yang @ 2018-11-21 16:58 ` Jakub Kicinski 2018-11-21 17:18 ` Y Song 1 sibling, 0 replies; 5+ messages in thread From: Jakub Kicinski @ 2018-11-21 16:58 UTC (permalink / raw) To: Wen Yang Cc: ast, daniel, quentin.monnet, jiong.wang, guro, sandipan, john.fastabend, netdev, linux-kernel, zhong.weidong, wang.yi59, Julia Lawall On Wed, 21 Nov 2018 15:43:12 +0800, Wen Yang wrote: > This patch fixes a possible null pointer dereference in > do_load, detected by the semantic patch > deref_null.cocci, with the following warning: > > ./tools/bpf/bpftool/prog.c:1021:23-25: ERROR: map_replace is NULL but dereferenced. > > The following code has potential null pointer references: > 881 map_replace = reallocarray(map_replace, old_map_fds + 1, > 882 sizeof(*map_replace)); > 883 if (!map_replace) { > 884 p_err("mem alloc failed"); > 885 goto err_free_reuse_maps; > 886 } > > ... > 1019 err_free_reuse_maps: > 1020 for (i = 0; i < old_map_fds; i++) > 1021 close(map_replace[i].fd); > 1022 free(map_replace); Ugh, good catch and very nice commit message! However, I think the resolution is wrong. We still want to free the old maps. Note that reallocarray() does not free the old array when reallocation fails, so we just shouldn't overwrite the map_replace with the return value. Like this, maybe: diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c index 5302ee282409..be319c0eb94d 100644 --- a/tools/bpf/bpftool/prog.c +++ b/tools/bpf/bpftool/prog.c @@ -846,6 +846,7 @@ static int do_load(int argc, char **argv) NEXT_ARG(); } else if (is_prefix(*argv, "map")) { char *endptr, *name; + void *new_map_replace; int fd; NEXT_ARG(); @@ -878,12 +879,15 @@ static int do_load(int argc, char **argv) if (fd < 0) goto err_free_reuse_maps; - map_replace = reallocarray(map_replace, old_map_fds + 1, - sizeof(*map_replace)); - if (!map_replace) { + new_map_replace = reallocarray(map_replace, + old_map_fds + 1, + sizeof(*map_replace)); + if (!new_map_replace) { p_err("mem alloc failed"); goto err_free_reuse_maps; } + map_replace = new_map_replace; + map_replace[old_map_fds].idx = idx; map_replace[old_map_fds].name = name; map_replace[old_map_fds].fd = fd; > Signed-off-by: Wen Yang <wen.yang99@zte.com.cn> > Reviewed-by: Tan Hu <tan.hu@zte.com.cn> > CC: Julia Lawall <julia.lawall@lip6.fr> > --- > tools/bpf/bpftool/prog.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c > index 5302ee2..de42187 100644 > --- a/tools/bpf/bpftool/prog.c > +++ b/tools/bpf/bpftool/prog.c > @@ -1017,8 +1017,9 @@ static int do_load(int argc, char **argv) > err_close_obj: > bpf_object__close(obj); > err_free_reuse_maps: > - for (i = 0; i < old_map_fds; i++) > - close(map_replace[i].fd); > + if (map_replace) > + for (i = 0; i < old_map_fds; i++) > + close(map_replace[i].fd); > free(map_replace); > return -1; > } ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 3/4] tools: bpftool: fix potential NULL pointer dereference in do_load 2018-11-21 7:43 [PATCH 3/4] tools: bpftool: fix potential NULL pointer dereference in do_load Wen Yang 2018-11-21 16:58 ` Jakub Kicinski @ 2018-11-21 17:18 ` Y Song 2018-11-21 17:30 ` Jakub Kicinski 1 sibling, 1 reply; 5+ messages in thread From: Y Song @ 2018-11-21 17:18 UTC (permalink / raw) To: wen.yang99 Cc: Alexei Starovoitov, Daniel Borkmann, Jakub Kicinski, Quentin Monnet, Jiong Wang, guro, Sandipan Das, John Fastabend, netdev, LKML, zhong.weidong, wang.yi59, julia.lawall On Tue, Nov 20, 2018 at 11:42 PM Wen Yang <wen.yang99@zte.com.cn> wrote: > > This patch fixes a possible null pointer dereference in > do_load, detected by the semantic patch > deref_null.cocci, with the following warning: > > ./tools/bpf/bpftool/prog.c:1021:23-25: ERROR: map_replace is NULL but dereferenced. > > The following code has potential null pointer references: > 881 map_replace = reallocarray(map_replace, old_map_fds + 1, > 882 sizeof(*map_replace)); > 883 if (!map_replace) { > 884 p_err("mem alloc failed"); > 885 goto err_free_reuse_maps; > 886 } > > ... > 1019 err_free_reuse_maps: > 1020 for (i = 0; i < old_map_fds; i++) > 1021 close(map_replace[i].fd); > 1022 free(map_replace); I did not see any issues here. We have code looks like: 867 struct map_replace *map_replace = NULL; 868 struct bpf_program *prog = NULL, *pos; 869 unsigned int old_map_fds = 0; ... 948 map_replace = reallocarray(map_replace, old_map_fds + 1, 949 sizeof(*map_replace)); 950 if (!map_replace) { 951 p_err("mem alloc failed"); 952 goto err_free_reuse_maps; 953 } 954 map_replace[old_map_fds].idx = idx; 955 map_replace[old_map_fds].name = name; 956 map_replace[old_map_fds].fd = fd; 957 old_map_fds++; ... old_map_fds becomes non zero if and only if map_replace is not NULL. > Signed-off-by: Wen Yang <wen.yang99@zte.com.cn> > Reviewed-by: Tan Hu <tan.hu@zte.com.cn> > CC: Julia Lawall <julia.lawall@lip6.fr> > --- > tools/bpf/bpftool/prog.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c > index 5302ee2..de42187 100644 > --- a/tools/bpf/bpftool/prog.c > +++ b/tools/bpf/bpftool/prog.c > @@ -1017,8 +1017,9 @@ static int do_load(int argc, char **argv) > err_close_obj: > bpf_object__close(obj); > err_free_reuse_maps: > - for (i = 0; i < old_map_fds; i++) > - close(map_replace[i].fd); > + if (map_replace) > + for (i = 0; i < old_map_fds; i++) > + close(map_replace[i].fd); > free(map_replace); > return -1; > } > -- > 2.9.5 > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 3/4] tools: bpftool: fix potential NULL pointer dereference in do_load 2018-11-21 17:18 ` Y Song @ 2018-11-21 17:30 ` Jakub Kicinski 2018-11-21 17:45 ` Y Song 0 siblings, 1 reply; 5+ messages in thread From: Jakub Kicinski @ 2018-11-21 17:30 UTC (permalink / raw) To: Y Song Cc: wen.yang99, Alexei Starovoitov, Daniel Borkmann, Quentin Monnet, Jiong Wang, guro, Sandipan Das, John Fastabend, netdev, LKML, zhong.weidong, wang.yi59, julia.lawall On Wed, 21 Nov 2018 09:18:06 -0800, Y Song wrote: > On Tue, Nov 20, 2018 at 11:42 PM Wen Yang <wen.yang99@zte.com.cn> wrote: > > > > This patch fixes a possible null pointer dereference in > > do_load, detected by the semantic patch > > deref_null.cocci, with the following warning: > > > > ./tools/bpf/bpftool/prog.c:1021:23-25: ERROR: map_replace is NULL but dereferenced. > > > > The following code has potential null pointer references: > > 881 map_replace = reallocarray(map_replace, old_map_fds + 1, > > 882 sizeof(*map_replace)); > > 883 if (!map_replace) { > > 884 p_err("mem alloc failed"); > > 885 goto err_free_reuse_maps; > > 886 } > > > > ... > > 1019 err_free_reuse_maps: > > 1020 for (i = 0; i < old_map_fds; i++) > > 1021 close(map_replace[i].fd); > > 1022 free(map_replace); > > I did not see any issues here. > We have code looks like: > 867 struct map_replace *map_replace = NULL; > 868 struct bpf_program *prog = NULL, *pos; > 869 unsigned int old_map_fds = 0; > ... > 948 map_replace = reallocarray(map_replace, > old_map_fds + 1, > 949 sizeof(*map_replace)); > 950 if (!map_replace) { > 951 p_err("mem alloc failed"); > 952 goto err_free_reuse_maps; > 953 } > 954 map_replace[old_map_fds].idx = idx; > 955 map_replace[old_map_fds].name = name; > 956 map_replace[old_map_fds].fd = fd; > 957 old_map_fds++; > ... > > old_map_fds becomes non zero if and only if map_replace is not NULL. Note that this is a realloc in a loop, and map_replace will become NULL again if realloc fails. We should check the return value of realloc() without loosing the pointer to the old value. No? > > Signed-off-by: Wen Yang <wen.yang99@zte.com.cn> > > Reviewed-by: Tan Hu <tan.hu@zte.com.cn> > > CC: Julia Lawall <julia.lawall@lip6.fr> > > --- > > tools/bpf/bpftool/prog.c | 5 +++-- > > 1 file changed, 3 insertions(+), 2 deletions(-) > > > > diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c > > index 5302ee2..de42187 100644 > > --- a/tools/bpf/bpftool/prog.c > > +++ b/tools/bpf/bpftool/prog.c > > @@ -1017,8 +1017,9 @@ static int do_load(int argc, char **argv) > > err_close_obj: > > bpf_object__close(obj); > > err_free_reuse_maps: > > - for (i = 0; i < old_map_fds; i++) > > - close(map_replace[i].fd); > > + if (map_replace) > > + for (i = 0; i < old_map_fds; i++) > > + close(map_replace[i].fd); > > free(map_replace); > > return -1; > > } > > -- > > 2.9.5 > > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 3/4] tools: bpftool: fix potential NULL pointer dereference in do_load 2018-11-21 17:30 ` Jakub Kicinski @ 2018-11-21 17:45 ` Y Song 0 siblings, 0 replies; 5+ messages in thread From: Y Song @ 2018-11-21 17:45 UTC (permalink / raw) To: Jakub Kicinski Cc: wen.yang99, Alexei Starovoitov, Daniel Borkmann, Quentin Monnet, Jiong Wang, guro, Sandipan Das, John Fastabend, netdev, LKML, zhong.weidong, wang.yi59, julia.lawall On Wed, Nov 21, 2018 at 9:30 AM Jakub Kicinski <jakub.kicinski@netronome.com> wrote: > > On Wed, 21 Nov 2018 09:18:06 -0800, Y Song wrote: > > On Tue, Nov 20, 2018 at 11:42 PM Wen Yang <wen.yang99@zte.com.cn> wrote: > > > > > > This patch fixes a possible null pointer dereference in > > > do_load, detected by the semantic patch > > > deref_null.cocci, with the following warning: > > > > > > ./tools/bpf/bpftool/prog.c:1021:23-25: ERROR: map_replace is NULL but dereferenced. > > > > > > The following code has potential null pointer references: > > > 881 map_replace = reallocarray(map_replace, old_map_fds + 1, > > > 882 sizeof(*map_replace)); > > > 883 if (!map_replace) { > > > 884 p_err("mem alloc failed"); > > > 885 goto err_free_reuse_maps; > > > 886 } > > > > > > ... > > > 1019 err_free_reuse_maps: > > > 1020 for (i = 0; i < old_map_fds; i++) > > > 1021 close(map_replace[i].fd); > > > 1022 free(map_replace); > > > > I did not see any issues here. > > We have code looks like: > > 867 struct map_replace *map_replace = NULL; > > 868 struct bpf_program *prog = NULL, *pos; > > 869 unsigned int old_map_fds = 0; > > ... > > 948 map_replace = reallocarray(map_replace, > > old_map_fds + 1, > > 949 sizeof(*map_replace)); > > 950 if (!map_replace) { > > 951 p_err("mem alloc failed"); > > 952 goto err_free_reuse_maps; > > 953 } > > 954 map_replace[old_map_fds].idx = idx; > > 955 map_replace[old_map_fds].name = name; > > 956 map_replace[old_map_fds].fd = fd; > > 957 old_map_fds++; > > ... > > > > old_map_fds becomes non zero if and only if map_replace is not NULL. > > Note that this is a realloc in a loop, and map_replace will become NULL > again if realloc fails. We should check the return value of realloc() > without loosing the pointer to the old value. No? Or right. Agreed. The right fix seems to restore the old map_replace in the error path and jump to err_free_reuse_maps if reallocarray fails. > > > > Signed-off-by: Wen Yang <wen.yang99@zte.com.cn> > > > Reviewed-by: Tan Hu <tan.hu@zte.com.cn> > > > CC: Julia Lawall <julia.lawall@lip6.fr> > > > --- > > > tools/bpf/bpftool/prog.c | 5 +++-- > > > 1 file changed, 3 insertions(+), 2 deletions(-) > > > > > > diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c > > > index 5302ee2..de42187 100644 > > > --- a/tools/bpf/bpftool/prog.c > > > +++ b/tools/bpf/bpftool/prog.c > > > @@ -1017,8 +1017,9 @@ static int do_load(int argc, char **argv) > > > err_close_obj: > > > bpf_object__close(obj); > > > err_free_reuse_maps: > > > - for (i = 0; i < old_map_fds; i++) > > > - close(map_replace[i].fd); > > > + if (map_replace) > > > + for (i = 0; i < old_map_fds; i++) > > > + close(map_replace[i].fd); > > > free(map_replace); > > > return -1; > > > } > > > -- > > > 2.9.5 > > > > ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-11-21 17:46 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2018-11-21 7:43 [PATCH 3/4] tools: bpftool: fix potential NULL pointer dereference in do_load Wen Yang 2018-11-21 16:58 ` Jakub Kicinski 2018-11-21 17:18 ` Y Song 2018-11-21 17:30 ` Jakub Kicinski 2018-11-21 17:45 ` Y Song
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).