Commit 1479eaff authored by Eduard Zingerman's avatar Eduard Zingerman Committed by Alexei Starovoitov

bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable

Test case dummy_st_ops/dummy_init_ret_value passes NULL as the first
parameter of the test_1() function. Mark this parameter as nullable to
make verifier aware of such possibility.
Otherwise, NULL check in the test_1() code:

      SEC("struct_ops/test_1")
      int BPF_PROG(test_1, struct bpf_dummy_ops_state *state)
      {
            if (!state)
                    return ...;

            ... access state ...
      }

Might be removed by verifier, thus triggering NULL pointer dereference
under certain conditions.
Reported-by: default avatarJose E. Marchesi <jemarch@gnu.org>
Signed-off-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20240424012821.595216-2-eddyz87@gmail.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 638a485c
...@@ -232,7 +232,7 @@ static void bpf_dummy_unreg(void *kdata) ...@@ -232,7 +232,7 @@ static void bpf_dummy_unreg(void *kdata)
{ {
} }
static int bpf_dummy_test_1(struct bpf_dummy_ops_state *cb) static int bpf_dummy_ops__test_1(struct bpf_dummy_ops_state *cb__nullable)
{ {
return 0; return 0;
} }
...@@ -249,7 +249,7 @@ static int bpf_dummy_test_sleepable(struct bpf_dummy_ops_state *cb) ...@@ -249,7 +249,7 @@ static int bpf_dummy_test_sleepable(struct bpf_dummy_ops_state *cb)
} }
static struct bpf_dummy_ops __bpf_bpf_dummy_ops = { static struct bpf_dummy_ops __bpf_bpf_dummy_ops = {
.test_1 = bpf_dummy_test_1, .test_1 = bpf_dummy_ops__test_1,
.test_2 = bpf_dummy_test_2, .test_2 = bpf_dummy_test_2,
.test_sleepable = bpf_dummy_test_sleepable, .test_sleepable = bpf_dummy_test_sleepable,
}; };
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment