From: Jakub Kicinski <jakub.kicinski@netronome.com>
To: Wen Yang <wen.yang99@zte.com.cn>
Cc: ast@kernel.org, daniel@iogearbox.net,
quentin.monnet@netronome.com, jiong.wang@netronome.com,
guro@fb.com, sandipan@linux.vnet.ibm.com,
john.fastabend@gmail.com, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, zhong.weidong@zte.com.cn,
wang.yi59@zte.com.cn, Julia Lawall <julia.lawall@lip6.fr>
Subject: Re: [PATCH 3/4] tools: bpftool: fix potential NULL pointer dereference in do_load
Date: Wed, 21 Nov 2018 08:58:52 -0800 [thread overview]
Message-ID: <20181121085852.31578bb4@cakuba.netronome.com> (raw)
In-Reply-To: <1542786192-19164-1-git-send-email-wen.yang99@zte.com.cn>
On Wed, 21 Nov 2018 15:43:12 +0800, Wen Yang wrote:
> This patch fixes a possible null pointer dereference in
> do_load, detected by the semantic patch
> deref_null.cocci, with the following warning:
>
> ./tools/bpf/bpftool/prog.c:1021:23-25: ERROR: map_replace is NULL but dereferenced.
>
> The following code has potential null pointer references:
> 881 map_replace = reallocarray(map_replace, old_map_fds + 1,
> 882 sizeof(*map_replace));
> 883 if (!map_replace) {
> 884 p_err("mem alloc failed");
> 885 goto err_free_reuse_maps;
> 886 }
>
> ...
> 1019 err_free_reuse_maps:
> 1020 for (i = 0; i < old_map_fds; i++)
> 1021 close(map_replace[i].fd);
> 1022 free(map_replace);
Ugh, good catch and very nice commit message! However, I think the
resolution is wrong. We still want to free the old maps. Note that
reallocarray() does not free the old array when reallocation fails, so
we just shouldn't overwrite the map_replace with the return value.
Like this, maybe:
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 5302ee282409..be319c0eb94d 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -846,6 +846,7 @@ static int do_load(int argc, char **argv)
NEXT_ARG();
} else if (is_prefix(*argv, "map")) {
char *endptr, *name;
+ void *new_map_replace;
int fd;
NEXT_ARG();
@@ -878,12 +879,15 @@ static int do_load(int argc, char **argv)
if (fd < 0)
goto err_free_reuse_maps;
- map_replace = reallocarray(map_replace, old_map_fds + 1,
- sizeof(*map_replace));
- if (!map_replace) {
+ new_map_replace = reallocarray(map_replace,
+ old_map_fds + 1,
+ sizeof(*map_replace));
+ if (!new_map_replace) {
p_err("mem alloc failed");
goto err_free_reuse_maps;
}
+ map_replace = new_map_replace;
+
map_replace[old_map_fds].idx = idx;
map_replace[old_map_fds].name = name;
map_replace[old_map_fds].fd = fd;
> Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
> Reviewed-by: Tan Hu <tan.hu@zte.com.cn>
> CC: Julia Lawall <julia.lawall@lip6.fr>
> ---
> tools/bpf/bpftool/prog.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
> index 5302ee2..de42187 100644
> --- a/tools/bpf/bpftool/prog.c
> +++ b/tools/bpf/bpftool/prog.c
> @@ -1017,8 +1017,9 @@ static int do_load(int argc, char **argv)
> err_close_obj:
> bpf_object__close(obj);
> err_free_reuse_maps:
> - for (i = 0; i < old_map_fds; i++)
> - close(map_replace[i].fd);
> + if (map_replace)
> + for (i = 0; i < old_map_fds; i++)
> + close(map_replace[i].fd);
> free(map_replace);
> return -1;
> }
next prev parent reply other threads:[~2018-11-21 16:58 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-21 7:43 [PATCH 3/4] tools: bpftool: fix potential NULL pointer dereference in do_load Wen Yang
2018-11-21 16:58 ` Jakub Kicinski [this message]
2018-11-21 17:18 ` Y Song
2018-11-21 17:30 ` Jakub Kicinski
2018-11-21 17:45 ` Y Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181121085852.31578bb4@cakuba.netronome.com \
--to=jakub.kicinski@netronome.com \
--cc=ast@kernel.org \
--cc=daniel@iogearbox.net \
--cc=guro@fb.com \
--cc=jiong.wang@netronome.com \
--cc=john.fastabend@gmail.com \
--cc=julia.lawall@lip6.fr \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=quentin.monnet@netronome.com \
--cc=sandipan@linux.vnet.ibm.com \
--cc=wang.yi59@zte.com.cn \
--cc=wen.yang99@zte.com.cn \
--cc=zhong.weidong@zte.com.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).