• Kumar Kartikeya Dwivedi's avatar
    bpf: Silence Coverity warning for find_kfunc_desc_btf · 588cd7ef
    Kumar Kartikeya Dwivedi authored
    The helper function returns a pointer that in the failure case encodes
    an error in the struct btf pointer. The current code lead to Coverity
    warning about the use of the invalid pointer:
    
     *** CID 1507963:  Memory - illegal accesses  (USE_AFTER_FREE)
     /kernel/bpf/verifier.c: 1788 in find_kfunc_desc_btf()
     1782                          return ERR_PTR(-EINVAL);
     1783                  }
     1784
     1785                  kfunc_btf = __find_kfunc_desc_btf(env, offset, btf_modp);
     1786                  if (IS_ERR_OR_NULL(kfunc_btf)) {
     1787                          verbose(env, "cannot find module BTF for func_id %u\n", func_id);
     >>>      CID 1507963:  Memory - illegal accesses  (USE_AFTER_FREE)
     >>>      Using freed pointer "kfunc_btf".
     1788                          return kfunc_btf ?: ERR_PTR(-ENOENT);
     1789                  }
     1790                  return kfunc_btf;
     1791          }
     1792          return btf_vmlinux ?: ERR_PTR(-ENOENT);
     1793     }
    
    Daniel suggested the use of ERR_CAST so that the intended use is clear
    to Coverity, but on closer look it seems that we never return NULL from
    the helper. Andrii noted that since __find_kfunc_desc_btf already logs
    errors for all cases except btf_get_by_fd, it is much easier to add
    logging for that and remove the IS_ERR check altogether, returning
    directly from it.
    Suggested-by: default avatarAndrii Nakryiko <andrii@kernel.org>
    Signed-off-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
    Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
    Link: https://lore.kernel.org/bpf/20211009040900.803436-1-memxor@gmail.com
    588cd7ef
verifier.c 400 KB