This patch fixes a possible null pointer dereference in
do_load, detected by the semantic patch
deref_null.cocci, with the following warning:
./tools/bpf/bpftool/prog.c:1021:23-25: ERROR: map_replace is NULL but dereferenced.
The following code has potential null pointer references:
881 map_replace = reallocarray(map_replace, old_map_fds + 1,
882 sizeof(*map_replace));
883 if (!map_replace) {
884 p_err("mem alloc failed");
885 goto err_free_reuse_maps;
886 }
...
1019 err_free_reuse_maps:
1020 for (i = 0; i < old_map_fds; i++)
1021 close(map_replace[i].fd);
1022 free(map_replace);
Signed-off-by: Wen Yang <[email protected]>
Reviewed-by: Tan Hu <[email protected]>
CC: Julia Lawall <[email protected]>
---
tools/bpf/bpftool/prog.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 5302ee2..de42187 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -1017,8 +1017,9 @@ static int do_load(int argc, char **argv)
err_close_obj:
bpf_object__close(obj);
err_free_reuse_maps:
- for (i = 0; i < old_map_fds; i++)
- close(map_replace[i].fd);
+ if (map_replace)
+ for (i = 0; i < old_map_fds; i++)
+ close(map_replace[i].fd);
free(map_replace);
return -1;
}
--
2.9.5
On Tue, Nov 20, 2018 at 11:42 PM Wen Yang <[email protected]> wrote:
>
> This patch fixes a possible null pointer dereference in
> do_load, detected by the semantic patch
> deref_null.cocci, with the following warning:
>
> ./tools/bpf/bpftool/prog.c:1021:23-25: ERROR: map_replace is NULL but dereferenced.
>
> The following code has potential null pointer references:
> 881 map_replace = reallocarray(map_replace, old_map_fds + 1,
> 882 sizeof(*map_replace));
> 883 if (!map_replace) {
> 884 p_err("mem alloc failed");
> 885 goto err_free_reuse_maps;
> 886 }
>
> ...
> 1019 err_free_reuse_maps:
> 1020 for (i = 0; i < old_map_fds; i++)
> 1021 close(map_replace[i].fd);
> 1022 free(map_replace);
I did not see any issues here.
We have code looks like:
867 struct map_replace *map_replace = NULL;
868 struct bpf_program *prog = NULL, *pos;
869 unsigned int old_map_fds = 0;
...
948 map_replace = reallocarray(map_replace,
old_map_fds + 1,
949 sizeof(*map_replace));
950 if (!map_replace) {
951 p_err("mem alloc failed");
952 goto err_free_reuse_maps;
953 }
954 map_replace[old_map_fds].idx = idx;
955 map_replace[old_map_fds].name = name;
956 map_replace[old_map_fds].fd = fd;
957 old_map_fds++;
...
old_map_fds becomes non zero if and only if map_replace is not NULL.
> Signed-off-by: Wen Yang <[email protected]>
> Reviewed-by: Tan Hu <[email protected]>
> CC: Julia Lawall <[email protected]>
> ---
> tools/bpf/bpftool/prog.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
> index 5302ee2..de42187 100644
> --- a/tools/bpf/bpftool/prog.c
> +++ b/tools/bpf/bpftool/prog.c
> @@ -1017,8 +1017,9 @@ static int do_load(int argc, char **argv)
> err_close_obj:
> bpf_object__close(obj);
> err_free_reuse_maps:
> - for (i = 0; i < old_map_fds; i++)
> - close(map_replace[i].fd);
> + if (map_replace)
> + for (i = 0; i < old_map_fds; i++)
> + close(map_replace[i].fd);
> free(map_replace);
> return -1;
> }
> --
> 2.9.5
>
On Wed, 21 Nov 2018 15:43:12 +0800, Wen Yang wrote:
> This patch fixes a possible null pointer dereference in
> do_load, detected by the semantic patch
> deref_null.cocci, with the following warning:
>
> ./tools/bpf/bpftool/prog.c:1021:23-25: ERROR: map_replace is NULL but dereferenced.
>
> The following code has potential null pointer references:
> 881 map_replace = reallocarray(map_replace, old_map_fds + 1,
> 882 sizeof(*map_replace));
> 883 if (!map_replace) {
> 884 p_err("mem alloc failed");
> 885 goto err_free_reuse_maps;
> 886 }
>
> ...
> 1019 err_free_reuse_maps:
> 1020 for (i = 0; i < old_map_fds; i++)
> 1021 close(map_replace[i].fd);
> 1022 free(map_replace);
Ugh, good catch and very nice commit message! However, I think the
resolution is wrong. We still want to free the old maps. Note that
reallocarray() does not free the old array when reallocation fails, so
we just shouldn't overwrite the map_replace with the return value.
Like this, maybe:
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 5302ee282409..be319c0eb94d 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -846,6 +846,7 @@ static int do_load(int argc, char **argv)
NEXT_ARG();
} else if (is_prefix(*argv, "map")) {
char *endptr, *name;
+ void *new_map_replace;
int fd;
NEXT_ARG();
@@ -878,12 +879,15 @@ static int do_load(int argc, char **argv)
if (fd < 0)
goto err_free_reuse_maps;
- map_replace = reallocarray(map_replace, old_map_fds + 1,
- sizeof(*map_replace));
- if (!map_replace) {
+ new_map_replace = reallocarray(map_replace,
+ old_map_fds + 1,
+ sizeof(*map_replace));
+ if (!new_map_replace) {
p_err("mem alloc failed");
goto err_free_reuse_maps;
}
+ map_replace = new_map_replace;
+
map_replace[old_map_fds].idx = idx;
map_replace[old_map_fds].name = name;
map_replace[old_map_fds].fd = fd;
> Signed-off-by: Wen Yang <[email protected]>
> Reviewed-by: Tan Hu <[email protected]>
> CC: Julia Lawall <[email protected]>
> ---
> tools/bpf/bpftool/prog.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
> index 5302ee2..de42187 100644
> --- a/tools/bpf/bpftool/prog.c
> +++ b/tools/bpf/bpftool/prog.c
> @@ -1017,8 +1017,9 @@ static int do_load(int argc, char **argv)
> err_close_obj:
> bpf_object__close(obj);
> err_free_reuse_maps:
> - for (i = 0; i < old_map_fds; i++)
> - close(map_replace[i].fd);
> + if (map_replace)
> + for (i = 0; i < old_map_fds; i++)
> + close(map_replace[i].fd);
> free(map_replace);
> return -1;
> }
On Wed, 21 Nov 2018 09:18:06 -0800, Y Song wrote:
> On Tue, Nov 20, 2018 at 11:42 PM Wen Yang <[email protected]> wrote:
> >
> > This patch fixes a possible null pointer dereference in
> > do_load, detected by the semantic patch
> > deref_null.cocci, with the following warning:
> >
> > ./tools/bpf/bpftool/prog.c:1021:23-25: ERROR: map_replace is NULL but dereferenced.
> >
> > The following code has potential null pointer references:
> > 881 map_replace = reallocarray(map_replace, old_map_fds + 1,
> > 882 sizeof(*map_replace));
> > 883 if (!map_replace) {
> > 884 p_err("mem alloc failed");
> > 885 goto err_free_reuse_maps;
> > 886 }
> >
> > ...
> > 1019 err_free_reuse_maps:
> > 1020 for (i = 0; i < old_map_fds; i++)
> > 1021 close(map_replace[i].fd);
> > 1022 free(map_replace);
>
> I did not see any issues here.
> We have code looks like:
> 867 struct map_replace *map_replace = NULL;
> 868 struct bpf_program *prog = NULL, *pos;
> 869 unsigned int old_map_fds = 0;
> ...
> 948 map_replace = reallocarray(map_replace,
> old_map_fds + 1,
> 949 sizeof(*map_replace));
> 950 if (!map_replace) {
> 951 p_err("mem alloc failed");
> 952 goto err_free_reuse_maps;
> 953 }
> 954 map_replace[old_map_fds].idx = idx;
> 955 map_replace[old_map_fds].name = name;
> 956 map_replace[old_map_fds].fd = fd;
> 957 old_map_fds++;
> ...
>
> old_map_fds becomes non zero if and only if map_replace is not NULL.
Note that this is a realloc in a loop, and map_replace will become NULL
again if realloc fails. We should check the return value of realloc()
without loosing the pointer to the old value. No?
> > Signed-off-by: Wen Yang <[email protected]>
> > Reviewed-by: Tan Hu <[email protected]>
> > CC: Julia Lawall <[email protected]>
> > ---
> > tools/bpf/bpftool/prog.c | 5 +++--
> > 1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
> > index 5302ee2..de42187 100644
> > --- a/tools/bpf/bpftool/prog.c
> > +++ b/tools/bpf/bpftool/prog.c
> > @@ -1017,8 +1017,9 @@ static int do_load(int argc, char **argv)
> > err_close_obj:
> > bpf_object__close(obj);
> > err_free_reuse_maps:
> > - for (i = 0; i < old_map_fds; i++)
> > - close(map_replace[i].fd);
> > + if (map_replace)
> > + for (i = 0; i < old_map_fds; i++)
> > + close(map_replace[i].fd);
> > free(map_replace);
> > return -1;
> > }
> > --
> > 2.9.5
> >
On Wed, Nov 21, 2018 at 9:30 AM Jakub Kicinski
<[email protected]> wrote:
>
> On Wed, 21 Nov 2018 09:18:06 -0800, Y Song wrote:
> > On Tue, Nov 20, 2018 at 11:42 PM Wen Yang <[email protected]> wrote:
> > >
> > > This patch fixes a possible null pointer dereference in
> > > do_load, detected by the semantic patch
> > > deref_null.cocci, with the following warning:
> > >
> > > ./tools/bpf/bpftool/prog.c:1021:23-25: ERROR: map_replace is NULL but dereferenced.
> > >
> > > The following code has potential null pointer references:
> > > 881 map_replace = reallocarray(map_replace, old_map_fds + 1,
> > > 882 sizeof(*map_replace));
> > > 883 if (!map_replace) {
> > > 884 p_err("mem alloc failed");
> > > 885 goto err_free_reuse_maps;
> > > 886 }
> > >
> > > ...
> > > 1019 err_free_reuse_maps:
> > > 1020 for (i = 0; i < old_map_fds; i++)
> > > 1021 close(map_replace[i].fd);
> > > 1022 free(map_replace);
> >
> > I did not see any issues here.
> > We have code looks like:
> > 867 struct map_replace *map_replace = NULL;
> > 868 struct bpf_program *prog = NULL, *pos;
> > 869 unsigned int old_map_fds = 0;
> > ...
> > 948 map_replace = reallocarray(map_replace,
> > old_map_fds + 1,
> > 949 sizeof(*map_replace));
> > 950 if (!map_replace) {
> > 951 p_err("mem alloc failed");
> > 952 goto err_free_reuse_maps;
> > 953 }
> > 954 map_replace[old_map_fds].idx = idx;
> > 955 map_replace[old_map_fds].name = name;
> > 956 map_replace[old_map_fds].fd = fd;
> > 957 old_map_fds++;
> > ...
> >
> > old_map_fds becomes non zero if and only if map_replace is not NULL.
>
> Note that this is a realloc in a loop, and map_replace will become NULL
> again if realloc fails. We should check the return value of realloc()
> without loosing the pointer to the old value. No?
Or right. Agreed. The right fix seems to restore the old map_replace
in the error path
and jump to err_free_reuse_maps if reallocarray fails.
>
> > > Signed-off-by: Wen Yang <[email protected]>
> > > Reviewed-by: Tan Hu <[email protected]>
> > > CC: Julia Lawall <[email protected]>
> > > ---
> > > tools/bpf/bpftool/prog.c | 5 +++--
> > > 1 file changed, 3 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
> > > index 5302ee2..de42187 100644
> > > --- a/tools/bpf/bpftool/prog.c
> > > +++ b/tools/bpf/bpftool/prog.c
> > > @@ -1017,8 +1017,9 @@ static int do_load(int argc, char **argv)
> > > err_close_obj:
> > > bpf_object__close(obj);
> > > err_free_reuse_maps:
> > > - for (i = 0; i < old_map_fds; i++)
> > > - close(map_replace[i].fd);
> > > + if (map_replace)
> > > + for (i = 0; i < old_map_fds; i++)
> > > + close(map_replace[i].fd);
> > > free(map_replace);
> > > return -1;
> > > }
> > > --
> > > 2.9.5
> > >
>