linux-kernel - Re: [PATH v2] bpftool: Fix memory leak in dump_xx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e938ef54-3ea0-4325-9860-477561af6042@qmon.net>
Date: Thu, 19 Jun 2025 09:45:19 +0100
From: Quentin Monnet <qmo@...n.net>
To: chenyuan <chenyuan_fl@....com>, ast@...nel.org, andrii@...nel.org
Cc: bpf@...r.kernel.org, linux-kernel@...r.kernel.org,
 chenyuan <chenyuan@...inos.cn>
Subject: Re: [PATH v2] bpftool: Fix memory leak in dump_xx_nlmsg on realloc
 failure

2025-06-19 14:57 UTC+0800 ~ chenyuan <chenyuan_fl@....com>
> From: chenyuan <chenyuan@...inos.cn>
> 
> In function dump_xx_nlmsg(), when realloc() fails to allocate memory,
> the original pointer to the buffer is overwritten with NULL. This causes
> a memory leak because the previously allocated buffer becomes unreachable
> without being freed.
> 
> Fix: 7900efc19214 ("tools/bpf: bpftool: improve output format for bpftool net")


Fixes: 7900efc19214 ("tools/bpf: bpftool: improve output format for bpftool net")

(Not "Fix:")


> Signed-off-by: chenyuan <chenyuan@...inos.cn>
> ---
>  tools/bpf/bpftool/net.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
> 
> diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c
> index 64f958f437b0..1abedfe6f33f 100644
> --- a/tools/bpf/bpftool/net.c
> +++ b/tools/bpf/bpftool/net.c
> @@ -366,17 +366,18 @@ static int dump_link_nlmsg(void *cookie, void *msg, struct nlattr **tb)
>  {
>  	struct bpf_netdev_t *netinfo = cookie;
>  	struct ifinfomsg *ifinfo = msg;
> +	struct ip_devname_ifindex *tmp;
>  
>  	if (netinfo->filter_idx > 0 && netinfo->filter_idx != ifinfo->ifi_index)
>  		return 0;
>  
>  	if (netinfo->used_len == netinfo->array_len) {
> -		netinfo->devices = realloc(netinfo->devices,
> -			(netinfo->array_len + 16) *
> +		tmp = realloc(netinfo->devices, (netinfo->array_len + 16) *
>  			sizeof(struct ip_devname_ifindex));


Nit: Can you please break the line after the comma rather than after the '*' sign,
like in dump_class_qdisc_nlmsg()?

Otherwise looks good, thanks for this! You can add my tag for v3:

Reviewed-by: Quentin Monnet <qmo@...nel.org>