Received-SPF: pass (google.com: domain of linux-kernel+bounces-13582-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Message-ID: <2c4ef323-4ed7-4b43-8dfe-b55aeecaa3bf@web.de>
Date: Sat, 30 Dec 2023 21:06:18 +0100
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: [PATCH 1/5] bpf: Improve exception handling in
 bpf_struct_ops_link_create()
Content-Language: en-GB
From: Markus Elfring <Markus.Elfring@web.de>
To: bpf@vger.kernel.org, netdev@vger.kernel.org,
 kernel-janitors@vger.kernel.org, Alexei Starovoitov <ast@kernel.org>,
 Andrii Nakryiko <andrii@kernel.org>, Daniel Borkmann <daniel@iogearbox.net>,
 Hao Luo <haoluo@google.com>, Jiri Olsa <jolsa@kernel.org>,
 John Fastabend <john.fastabend@gmail.com>, KP Singh <kpsingh@kernel.org>,
 Martin KaFai Lau <martin.lau@linux.dev>, Song Liu <song@kernel.org>,
 Stanislav Fomichev <sdf@google.com>, Yonghong Song <yonghong.song@linux.dev>
Cc: LKML <linux-kernel@vger.kernel.org>
References: <7011cdcc-4287-4e63-8bfa-f08710f670b1@web.de>
In-Reply-To: <7011cdcc-4287-4e63-8bfa-f08710f670b1@web.de>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:juW6K/s+4Cg=;f9KejanXXCgaKD/YMUAkjb+PKOh
 NZ1KABzA54jNWyTHEcMkbriJRgAfvb2Mu8Vm5g31J7ttikxn+VVDnVZHrfsVE2sb974NcyoPB
 1XZsJlrk/sm8lSg+7aCcqnQ+5ydNQB/qtTDOIK6PCs1rVqBbSbUWak8o8CI6fcqUcH5rnEnF6
 e/yI1VbyDK6CCCurwwr+1rShIAxhHvqdtdO+eI2XI1TQZJqIaXMNdzfetVyPdUG6okIQmIeAh
 T1NbB4EHV8/qgYgNnn63zUbY5E9v5BMg24b36wMSyAdsw/5qoMFpsUgtfkGhiFJ74b1gPP0h0
 7RWCHVN9mlO5JUwcvySwz4wxC8ccWtFE1Q3W4njASSruuxHb8SHNbez5MAXJbDrh3B84ayA2j
 PqrfEeAnI9jnTA7nr40QjSn+4XOFz0toulO4iJIEKAg/BxMKmDyJGhPtedl0WNVDC3fS7YH7y
 tW8PitrX+XZYNikB59EgFgg/YRI5GN7U5xC8Dm8lC2aR61up2A0d9scwbw+hGsPkoi0IVcoFS
 4AnY5WyGAL8v+qXvr/cPHbvDVkAdFlXOa3CXeQVmEeobOIo7gn8Wf8Bf0ZhGuIYJZkr72IIzZ
 rKknj9AO44Y3E3cnrSdr4EtOviVIF2/kJcucQeJmcQHMpTr/gfKnbBBepN01zDjttz7Clh4aZ
 3dzCV0CLCd7yegKbpRR1x3rjtXbNkLyb6F0NpF75mg+DIreeXuZLpq0Jjv6XJ7ZnoAq837TVS
 O7gFffOgxcxqsXv8d5/Y3rEAhuFxnH6W+7rDVXwWvzeNWaHtxmH6aJbVX6sq9Fe5cZZaoYNZJ
 fkYzMxU3iglc7D8PpIDVwA346seOePP1otkraudIPvggQ4V6L9i0B3PTpFLnxkYmLoP78BYZw
 MUrPaYzS62uCWzY2mqda6lY06EkatAZHuTDF8UJMXqtmD71UqKRu+QG69mzGJW4Wx4D41w+DF
 EGIBPw==

From: Markus Elfring <elfring@users.sourceforge.net>
Date: Sat, 30 Dec 2023 18:50:45 +0100

The kfree() function was called in two cases by
the bpf_struct_ops_link_create() function during error handling
even if the passed variable contained a null pointer.
This issue was detected by using the Coccinelle software.

* Thus use another label.

* Reorder function calls at the end.

* Delete an initialisation (for the variable =E2=80=9Clink=E2=80=9D)
  which became unnecessary with this refactoring.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
=2D--
 kernel/bpf/bpf_struct_ops.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/kernel/bpf/bpf_struct_ops.c b/kernel/bpf/bpf_struct_ops.c
index 02068bd0e4d9..b49ea460d616 100644
=2D-- a/kernel/bpf/bpf_struct_ops.c
+++ b/kernel/bpf/bpf_struct_ops.c
@@ -888,7 +888,7 @@ static const struct bpf_link_ops bpf_struct_ops_map_lo=
ps =3D {

 int bpf_struct_ops_link_create(union bpf_attr *attr)
 {
-	struct bpf_struct_ops_link *link =3D NULL;
+	struct bpf_struct_ops_link *link;
 	struct bpf_link_primer link_primer;
 	struct bpf_struct_ops_map *st_map;
 	struct bpf_map *map;
@@ -902,13 +902,13 @@ int bpf_struct_ops_link_create(union bpf_attr *attr)

 	if (!bpf_struct_ops_valid_to_reg(map)) {
 		err =3D -EINVAL;
-		goto err_out;
+		goto put_map;
 	}

 	link =3D kzalloc(sizeof(*link), GFP_USER);
 	if (!link) {
 		err =3D -ENOMEM;
-		goto err_out;
+		goto put_map;
 	}
 	bpf_link_init(&link->link, BPF_LINK_TYPE_STRUCT_OPS, &bpf_struct_ops_map=
_lops, NULL);

@@ -927,7 +927,8 @@ int bpf_struct_ops_link_create(union bpf_attr *attr)
 	return bpf_link_settle(&link_primer);

 err_out:
-	bpf_map_put(map);
 	kfree(link);
+put_map:
+	bpf_map_put(map);
 	return err;
 }
=2D-
2.43.0