Commit dde7011a authored by Jakub Kicinski's avatar Jakub Kicinski Committed by Daniel Borkmann

tools: bpftool: fix potential NULL pointer dereference in do_load

This patch fixes a possible null pointer dereference in
do_load, detected by the semantic patch deref_null.cocci,
with the following warning:

./tools/bpf/bpftool/prog.c:1021:23-25: ERROR: map_replace is NULL but dereferenced.

The following code has potential null pointer references:
881             map_replace = reallocarray(map_replace, old_map_fds + 1,
882                                        sizeof(*map_replace));
883             if (!map_replace) {
884                     p_err("mem alloc failed");
885                     goto err_free_reuse_maps;
886             }

...
1019 err_free_reuse_maps:
1020         for (i = 0; i < old_map_fds; i++)
1021                 close(map_replace[i].fd);
1022         free(map_replace);

Fixes: 3ff5a4dc ("tools: bpftool: allow reuse of maps with bpftool prog load")
Co-developed-by: default avatarWen Yang <wen.yang99@zte.com.cn>
Signed-off-by: default avatarWen Yang <wen.yang99@zte.com.cn>
Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent 569a933b
...@@ -844,6 +844,7 @@ static int do_load(int argc, char **argv) ...@@ -844,6 +844,7 @@ static int do_load(int argc, char **argv)
} }
NEXT_ARG(); NEXT_ARG();
} else if (is_prefix(*argv, "map")) { } else if (is_prefix(*argv, "map")) {
void *new_map_replace;
char *endptr, *name; char *endptr, *name;
int fd; int fd;
...@@ -877,12 +878,15 @@ static int do_load(int argc, char **argv) ...@@ -877,12 +878,15 @@ static int do_load(int argc, char **argv)
if (fd < 0) if (fd < 0)
goto err_free_reuse_maps; goto err_free_reuse_maps;
map_replace = reallocarray(map_replace, old_map_fds + 1, new_map_replace = reallocarray(map_replace,
sizeof(*map_replace)); old_map_fds + 1,
if (!map_replace) { sizeof(*map_replace));
if (!new_map_replace) {
p_err("mem alloc failed"); p_err("mem alloc failed");
goto err_free_reuse_maps; goto err_free_reuse_maps;
} }
map_replace = new_map_replace;
map_replace[old_map_fds].idx = idx; map_replace[old_map_fds].idx = idx;
map_replace[old_map_fds].name = name; map_replace[old_map_fds].name = name;
map_replace[old_map_fds].fd = fd; map_replace[old_map_fds].fd = fd;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment