linux-kernel - Re: [PATCH] bpftool: fix potential NULL pointer dereferencing in prog

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <47225498-12ab-4e69-ac50-2aab9dbe62c0@kernel.org>
Date: Fri, 15 Nov 2024 13:42:56 +0000
From: Quentin Monnet <qmo@...nel.org>
To: Amir Mohammadi <amirmohammadi1999.am@...il.com>, ast@...nel.org,
 daniel@...earbox.net, andrii@...nel.org, martin.lau@...ux.dev,
 eddyz87@...il.com, song@...nel.org, yonghong.song@...ux.dev,
 john.fastabend@...il.com, kpsingh@...nel.org, sdf@...ichev.me,
 haoluo@...gle.com, jolsa@...nel.org, bpf@...r.kernel.org,
 linux-kernel@...r.kernel.org
Cc: Amir Mohammadi <amiremohamadi@...oo.com>
Subject: Re: [PATCH] bpftool: fix potential NULL pointer dereferencing in
 prog_dump()

2024-11-15 15:15 UTC+0330 ~ Amir Mohammadi <amirmohammadi1999.am@...il.com>
> A NULL pointer dereference could occur if ksyms
> is not properly checked before usage in the prog_dump() function.
> 
> Signed-off-by: Amir Mohammadi <amiremohamadi@...oo.com>
> ---
>  tools/bpf/bpftool/prog.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
> index 2ff949ea8..8b5300103 100644
> --- a/tools/bpf/bpftool/prog.c
> +++ b/tools/bpf/bpftool/prog.c
> @@ -822,11 +822,12 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
>  					printf("%s:\n", sym_name);
>  				}
>  
> -				if (disasm_print_insn(img, lens[i], opcodes,
> -						      name, disasm_opt, btf,
> -						      prog_linfo, ksyms[i], i,
> -						      linum))
> -					goto exit_free;
> +				if (ksyms)
> +					if (disasm_print_insn(img, lens[i], opcodes,
> +							      name, disasm_opt, btf,
> +							      prog_linfo, ksyms[i], i,
> +							      linum))
> +						goto exit_free;
>  
>  				img += lens[i];
>  


Thanks! But we don't want to skip dumping the instruction silently if we
don't have ksyms. So we'd need an 'else' block that does the same as if
no JITed functions are found I think, something calling:

	disasm_print_insn(img, lens[i], opcodes, name, disasm_opt, btf,
			  NULL, 0, 0, false)

Fixes: b053b439b72a ("bpf: libbpf: bpftool: Print bpf_line_info during prog dump")

Quentin