2020-06-10 03:04:17

by Gaurav Singh

Subject: [PATCH] xdp_rxq_info_user: Add null check after malloc

Signed-off-by: Gaurav Singh <[email protected]>

The memset call is made right after malloc call which
can return a NULL pointer upon failure causing a
segmentation fault. Fix this by adding a null check
right after malloc() and then do memset().

---
samples/bpf/xdp_rxq_info_user.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/samples/bpf/xdp_rxq_info_user.c b/samples/bpf/xdp_rxq_info_user.c
index 4fe47502ebed..2d03c84a4cca 100644
--- a/samples/bpf/xdp_rxq_info_user.c
+++ b/samples/bpf/xdp_rxq_info_user.c
@@ -202,11 +202,11 @@ static struct datarec *alloc_record_per_cpu(void)

size = sizeof(struct datarec) * nr_cpus;
array = malloc(size);
- memset(array, 0, size);
if (!array) {
fprintf(stderr, "Mem alloc error (nr_cpus:%u)\n", nr_cpus);
exit(EXIT_FAIL_MEM);
}
+ memset(array, 0, size);
return array;
}

@@ -218,11 +218,11 @@ static struct record *alloc_record_per_rxq(void)

size = sizeof(struct record) * nr_rxqs;
array = malloc(size);
- memset(array, 0, size);
if (!array) {
fprintf(stderr, "Mem alloc error (nr_rxqs:%u)\n", nr_rxqs);
exit(EXIT_FAIL_MEM);
}
+ memset(array, 0, size);
return array;
}

@@ -233,11 +233,11 @@ static struct stats_record *alloc_stats_record(void)
int i;

rec = malloc(sizeof(*rec));
- memset(rec, 0, sizeof(*rec));
if (!rec) {
fprintf(stderr, "Mem alloc error\n");
exit(EXIT_FAIL_MEM);
}
+ memset(rec, 0, sizeof(*rec));
rec->rxq = alloc_record_per_rxq();
for (i = 0; i < nr_rxqs; i++)
rec->rxq[i].cpu = alloc_record_per_cpu();
--
2.17.1

2020-06-11 14:15:51

by Daniel Borkmann

Subject: Re: [PATCH] xdp_rxq_info_user: Add null check after malloc

On 6/10/20 5:01 AM, Gaurav Singh wrote:
> Signed-off-by: Gaurav Singh <[email protected]>
>
> The memset call is made right after malloc call which
> can return a NULL pointer upon failure causing a
> segmentation fault. Fix this by adding a null check
> right after malloc() and then do memset().

The SoB should come after the commit message here.

> ---
> samples/bpf/xdp_rxq_info_user.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/samples/bpf/xdp_rxq_info_user.c b/samples/bpf/xdp_rxq_info_user.c
> index 4fe47502ebed..2d03c84a4cca 100644
> --- a/samples/bpf/xdp_rxq_info_user.c
> +++ b/samples/bpf/xdp_rxq_info_user.c
> @@ -202,11 +202,11 @@ static struct datarec *alloc_record_per_cpu(void)
>
> size = sizeof(struct datarec) * nr_cpus;
> array = malloc(size);
> - memset(array, 0, size);

All these below are candidates for calloc(), can we just use that instead and
simplify the below.

> if (!array) {
> fprintf(stderr, "Mem alloc error (nr_cpus:%u)\n", nr_cpus);
> exit(EXIT_FAIL_MEM);
> }
> + memset(array, 0, size);
> return array;
> }
>
> @@ -218,11 +218,11 @@ static struct record *alloc_record_per_rxq(void)
>
> size = sizeof(struct record) * nr_rxqs;
> array = malloc(size);
> - memset(array, 0, size);
> if (!array) {
> fprintf(stderr, "Mem alloc error (nr_rxqs:%u)\n", nr_rxqs);
> exit(EXIT_FAIL_MEM);
> }
> + memset(array, 0, size);
> return array;
> }
>
> @@ -233,11 +233,11 @@ static struct stats_record *alloc_stats_record(void)
> int i;
>
> rec = malloc(sizeof(*rec));
> - memset(rec, 0, sizeof(*rec));
> if (!rec) {
> fprintf(stderr, "Mem alloc error\n");
> exit(EXIT_FAIL_MEM);
> }
> + memset(rec, 0, sizeof(*rec));
> rec->rxq = alloc_record_per_rxq();
> for (i = 0; i < nr_rxqs; i++)
> rec->rxq[i].cpu = alloc_record_per_cpu();
>

Thanks,
Daniel