Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
MIME-Version: 1.0
References: <20220421130056.2510372-1-cuigaosheng1@huawei.com>
 <CAEf4Bza3inoAHsS0w=nKXNgxyFqzPXJVyDHq03Foody6Vgp7=Q@mail.gmail.com> <60b4e208-efed-c2fb-d1e0-125e5409c861@huawei.com>
In-Reply-To: <60b4e208-efed-c2fb-d1e0-125e5409c861@huawei.com>
From:   Andrii Nakryiko <andrii.nakryiko@gmail.com>
Date:   Fri, 22 Apr 2022 14:46:01 -0700
Message-ID: <CAEf4BzY3j8=uNvvwZXsFEANR84bXMWY2OH+eZi_sSsiLutYhVQ@mail.gmail.com>
Subject: Re: [PATCH -next] libbpf: Add additional null-pointer checking in make_parent_dir
To:     cuigaosheng <cuigaosheng1@huawei.com>
Cc:     Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>, Martin Lau <kafai@fb.com>,
        Song Liu <songliubraving@fb.com>, Yonghong Song <yhs@fb.com>,
        john fastabend <john.fastabend@gmail.com>,
        KP Singh <kpsingh@kernel.org>,
        Networking <netdev@vger.kernel.org>, bpf <bpf@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        gongruiqi1@huawei.com, wangweiyang2@huawei.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Thu, Apr 21, 2022 at 7:55 PM cuigaosheng <cuigaosheng1@huawei.com> wrote=
:
>
> This email adjusts the code format.
>
> I don't understand why we don't check path for NULL, bpf_link__pin is an
> external
> interface, It will be called by external functions and provide input
> parameters,

that external interface expects non-NULL string as input argument,
which is a default throughout libbpf's API. You will get SIGSEGV in
lots of cases if you pass NULL where you are not supposed to, e.g.,
bpf_object__open_file() and many others. It doesn't mean that libbpf
should check any pointer argument for NULL.

You can argue that strdup(NULL) shouldn't crash but it doesn't. It's
because strdup() has a contract that it shouldn't be passed NULL. So
is the case here.


> for example in samples/bpf/hbm.c:
>
> > 201         link =3D bpf_program__attach_cgroup(bpf_prog, cg1);
> > 202         if (libbpf_get_error(link)) {
> > 203                 fprintf(stderr, "ERROR: bpf_program__attach_cgroup
> > failed\n");
> > 204                 goto err;
> > 205         }
> > 206
> > 207         sprintf(cg_pin_path, "/sys/fs/bpf/hbm%d", cg_id);
> > 208         rc =3D bpf_link__pin(link, cg_pin_path);
> > 209         if (rc < 0) {
> > 210                 printf("ERROR: bpf_link__pin failed: %d\n", rc);
> > 211                 goto err;
> > 212         }
>
> if cg_pin_path is NULL, strdup(NULL) will trigger a segmentation fault in
> make_parent_dir, I think we should avoid this and add null-pointer checki=
ng
> for path, just like check_path:
> >  7673 static int check_path(const char *path)
> >  7674 {
> >  7675         char *cp, errmsg[STRERR_BUFSIZE];
> >  7676         struct statfs st_fs;
> >  7677         char *dname, *dir;
> >  7678         int err =3D 0;
> >  7679
> >  7680         if (path =3D=3D NULL)
> >  7681                 return -EINVAL;
> >  7682
> >  7683         dname =3D strdup(path);
> >  7684         if (dname =3D=3D NULL)
> >  7685                 return -ENOMEM;
> >  7686
> >  7687         dir =3D dirname(dname);
> >  7688         if (statfs(dir, &st_fs)) {
> >  7689                 cp =3D libbpf_strerror_r(errno, errmsg,
> > sizeof(errmsg));
> >  7690                 pr_warn("failed to statfs %s: %s\n", dir, cp);
> >  7691                 err =3D -errno;
> >  7692         }
> >  7693         free(dname);
> >  7694
> >  7695         if (!err && st_fs.f_type !=3D BPF_FS_MAGIC) {
> >  7696                 pr_warn("specified path %s is not on BPF FS\n",
> > path);
> >  7697                 err =3D -EINVAL;
> >  7698         }
> >  7699
> >  7700         return err;
> >  7701 }
>
> Thanks.
>
>
> =E5=9C=A8 2022/4/22 0:55, Andrii Nakryiko =E5=86=99=E9=81=93:
> > On Thu, Apr 21, 2022 at 6:01 AM Gaosheng Cui <cuigaosheng1@huawei.com> =
wrote:
> >> The make_parent_dir is called without null-pointer checking for path,
> >> such as bpf_link__pin. To ensure there is no null-pointer dereference
> >> in make_parent_dir, so make_parent_dir requires additional null-pointe=
r
> >> checking for path.
> >>
> >> Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
> >> ---
> >>   tools/lib/bpf/libbpf.c | 3 +++
> >>   1 file changed, 3 insertions(+)
> >>
> >> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> >> index b53e51884f9e..5786e6184bf5 100644
> >> --- a/tools/lib/bpf/libbpf.c
> >> +++ b/tools/lib/bpf/libbpf.c
> >> @@ -7634,6 +7634,9 @@ static int make_parent_dir(const char *path)
> >>          char *dname, *dir;
> >>          int err =3D 0;
> >>
> >> +       if (path =3D=3D NULL)
> >> +               return -EINVAL;
> >> +
> > API contract is that path shouldn't be NULL. Just like we don't check
> > link, obj, prog for NULL in every single API, I don't think we need to
> > do it here, unless I'm missing something?
> >
> >>          dname =3D strdup(path);
> >>          if (dname =3D=3D NULL)
> >>                  return -ENOMEM;
> >> --
> >> 2.25.1
> >>
> > .