linux-kernel - Re: [PATCH bpf-next] libbpf: fix errno is overwritten after being closed.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 29 Dec 2022 13:43:56 -0800
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Xin Liu <liuxin350@...wei.com>
Cc:     andrii@...nel.org, ast@...nel.org, daniel@...earbox.net,
        martin.lau@...ux.dev, song@...nel.org, yhs@...com,
        john.fastabend@...il.com, kpsingh@...nel.org, sdf@...gle.com,
        haoluo@...gle.com, jolsa@...nel.org, bpf@...r.kernel.org,
        linux-kernel@...r.kernel.org, yanan@...wei.com,
        wuchangye@...wei.com, xiesongyang@...wei.com,
        kongweibin2@...wei.com, zhangmingyi5@...wei.com
Subject: Re: [PATCH bpf-next] libbpf: fix errno is overwritten after being closed.

On Fri, Dec 23, 2022 at 5:36 AM Xin Liu <liuxin350@...wei.com> wrote:
>
> In the ensure_good_fd function, if the fcntl function succeeds but
> the close function fails, ensure_good_fd returns a normal fd and
> sets errno, which may cause users to misunderstand. The close
> failure is not a serious problem, and the correct FD has been
> handed over to the upper-layer application. Let's restore errno here.
>
> Signed-off-by: Xin Liu <liuxin350@...wei.com>
> ---
>  tools/lib/bpf/libbpf_internal.h | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/tools/lib/bpf/libbpf_internal.h b/tools/lib/bpf/libbpf_internal.h
> index 377642ff51fc..98333a6c38e9 100644
> --- a/tools/lib/bpf/libbpf_internal.h
> +++ b/tools/lib/bpf/libbpf_internal.h
> @@ -543,10 +543,9 @@ static inline int ensure_good_fd(int fd)
>                 fd = fcntl(fd, F_DUPFD_CLOEXEC, 3);
>                 saved_errno = errno;
>                 close(old_fd);
> -               if (fd < 0) {
> +               errno = saved_errno;
> +               if (fd < 0)
>                         pr_warn("failed to dup FD %d to FD > 2: %d\n", old_fd, -saved_errno);
> -                       errno = saved_errno;

pr_warn calls into user-provided callback, which can clobber errno, so
`errno = saved_errno` should happen after pr_warn. With your change
there is even higher chance of errno clobbering.

Please send a follow up fix to unconditionally restore errno *after*
pr_warn, thanks.

> -               }
>         }
>         return fd;
>  }
> --
> 2.33.0
>