• Andrii Nakryiko's avatar
    libbpf: Fix realloc API handling in zero-sized edge cases · 8a0260db
    Andrii Nakryiko authored
    realloc() and reallocarray() can either return NULL or a special
    non-NULL pointer, if their size argument is zero. This requires a bit
    more care to handle NULL-as-valid-result situation differently from
    NULL-as-error case. This has caused real issues before ([0]), and just
    recently bit again in production when performing bpf_program__attach_usdt().
    
    This patch fixes 4 places that do or potentially could suffer from this
    mishandling of NULL, including the reported USDT-related one.
    
    There are many other places where realloc()/reallocarray() is used and
    NULL is always treated as an error value, but all those have guarantees
    that their size is always non-zero, so those spot don't need any extra
    handling.
    
      [0] d08ab82f ("libbpf: Fix double-free when linker processes empty sections")
    
    Fixes: 999783c8 ("libbpf: Wire up spec management and other arch-independent USDT logic")
    Fixes: b63b3c49 ("libbpf: Add bpf_program__set_insns function")
    Fixes: 697f104d ("libbpf: Support custom SEC() handlers")
    Fixes: b1268826 ("libbpf: Change the order of data and text relocations.")
    Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Link: https://lore.kernel.org/bpf/20230711024150.1566433-1-andrii@kernel.org
    8a0260db
usdt.c 49.9 KB