| Message ID | 20190702102531.23512-1-leo.yan@linaro.org |
|---|---|
| State | Accepted |
| Commit | 33bae185f74d49a0d7b1bfaafb8e959efce0f243 |
| Headers | show |
| Series | bpf, libbpf: Smatch: Fix potential NULL pointer dereference | expand |
On 7/2/19 3:25 AM, Leo Yan wrote: > Based on the following report from Smatch, fix the potential > NULL pointer dereference check. > > tools/lib/bpf/libbpf.c:3493 > bpf_prog_load_xattr() warn: variable dereferenced before check 'attr' > (see line 3483) > > 3479 int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr, > 3480 struct bpf_object **pobj, int *prog_fd) > 3481 { > 3482 struct bpf_object_open_attr open_attr = { > 3483 .file = attr->file, > 3484 .prog_type = attr->prog_type, > ^^^^^^ > 3485 }; > > At the head of function, it directly access 'attr' without checking if > it's NULL pointer. This patch moves the values assignment after > validating 'attr' and 'attr->file'. > > Signed-off-by: Leo Yan <leo.yan@linaro.org> Acked-by: Yonghong Song <yhs@fb.com>
On 07/02/2019 12:25 PM, Leo Yan wrote: > Based on the following report from Smatch, fix the potential > NULL pointer dereference check. > > tools/lib/bpf/libbpf.c:3493 > bpf_prog_load_xattr() warn: variable dereferenced before check 'attr' > (see line 3483) > > 3479 int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr, > 3480 struct bpf_object **pobj, int *prog_fd) > 3481 { > 3482 struct bpf_object_open_attr open_attr = { > 3483 .file = attr->file, > 3484 .prog_type = attr->prog_type, > ^^^^^^ > 3485 }; > > At the head of function, it directly access 'attr' without checking if > it's NULL pointer. This patch moves the values assignment after > validating 'attr' and 'attr->file'. > > Signed-off-by: Leo Yan <leo.yan@linaro.org> > --- > tools/lib/bpf/libbpf.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c > index 197b574406b3..809b633fa3d9 100644 > --- a/tools/lib/bpf/libbpf.c > +++ b/tools/lib/bpf/libbpf.c > @@ -3479,10 +3479,7 @@ int bpf_prog_load(const char *file, enum bpf_prog_type type, > int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr, > struct bpf_object **pobj, int *prog_fd) > { > - struct bpf_object_open_attr open_attr = { > - .file = attr->file, > - .prog_type = attr->prog_type, > - }; Applied, thanks! Fyi, I retained the zeroing of open_attr as otherwise if we ever extend struct bpf_object_open_attr in future, we'll easily miss this and pass in garbage to bpf_object__open_xattr().
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c index 197b574406b3..809b633fa3d9 100644 --- a/tools/lib/bpf/libbpf.c +++ b/tools/lib/bpf/libbpf.c @@ -3479,10 +3479,7 @@ int bpf_prog_load(const char *file, enum bpf_prog_type type, int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr, struct bpf_object **pobj, int *prog_fd) { - struct bpf_object_open_attr open_attr = { - .file = attr->file, - .prog_type = attr->prog_type, - }; + struct bpf_object_open_attr open_attr; struct bpf_program *prog, *first_prog = NULL; enum bpf_attach_type expected_attach_type; enum bpf_prog_type prog_type; @@ -3495,6 +3492,9 @@ int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr, if (!attr->file) return -EINVAL; + open_attr.file = attr->file; + open_attr.prog_type = attr->prog_type; + obj = bpf_object__open_xattr(&open_attr); if (IS_ERR_OR_NULL(obj)) return -ENOENT;
Based on the following report from Smatch, fix the potential NULL pointer dereference check. tools/lib/bpf/libbpf.c:3493 bpf_prog_load_xattr() warn: variable dereferenced before check 'attr' (see line 3483) 3479 int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr, 3480 struct bpf_object **pobj, int *prog_fd) 3481 { 3482 struct bpf_object_open_attr open_attr = { 3483 .file = attr->file, 3484 .prog_type = attr->prog_type, ^^^^^^ 3485 }; At the head of function, it directly access 'attr' without checking if it's NULL pointer. This patch moves the values assignment after validating 'attr' and 'attr->file'. Signed-off-by: Leo Yan <leo.yan@linaro.org> --- tools/lib/bpf/libbpf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.17.1