linux-kernel - Re: [PATCH] bpftool: check for NULL ptr of btf in codegen_subskel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <dab1feb1-446d-46c7-a8b1-f0483cc149ea@linux.dev>
Date: Wed, 21 Aug 2024 10:57:39 -0700
From: Yonghong Song <yonghong.song@...ux.dev>
To: Ma Ke <make24@...as.ac.cn>, qmo@...nel.org, ast@...nel.org,
 daniel@...earbox.net, andrii@...nel.org, martin.lau@...ux.dev,
 eddyz87@...il.com, song@...nel.org, john.fastabend@...il.com,
 kpsingh@...nel.org, sdf@...ichev.me, haoluo@...gle.com, jolsa@...nel.org,
 delyank@...com
Cc: bpf@...r.kernel.org, linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] bpftool: check for NULL ptr of btf in
 codegen_subskel_datasecs


On 8/21/24 6:31 AM, Ma Ke wrote:
> bpf_object__btf() can return NULL value.  If bpf_object__btf returns null,
> do not progress through codegen_subskel_datasecs(). This avoids a null ptr
> dereference.
>
> Found by code review, complie tested only.

Do you have a real case to show null ptr reference here?
Code review and compile test are not enough. You should have
a real reproducible case before you send the patch.

For this particular case, we have check

         btf = bpf_object__btf(obj);
         if (!btf) {
                 err = -1;
                 p_err("need btf type information for %s", obj_name);
                 goto out;
         }

which ensures that btf is available before codegen for subskeleton,
so what you described won't happen in practice.
  

>
> Cc: stable@...r.kernel.org
> Fixes: 00389c58ffe9 ("bpftool: Add support for subskeletons")
> Signed-off-by: Ma Ke <make24@...as.ac.cn>
> ---
>   tools/bpf/bpftool/gen.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
> index 5a4d3240689e..7ce62f280310 100644
> --- a/tools/bpf/bpftool/gen.c
> +++ b/tools/bpf/bpftool/gen.c
> @@ -334,6 +334,9 @@ static int codegen_subskel_datasecs(struct bpf_object *obj, const char *obj_name
>   	const char *sec_name, *var_name;
>   	__u32 var_type_id;
>   
> +	if (!btf)
> +		return -EINVAL;
> +
>   	d = btf_dump__new(btf, codegen_btf_dump_printf, NULL, NULL);
>   	if (!d)
>   		return -errno;