Commit 33bae185 authored Jul 02, 2019 by Leo Yan Committed by Daniel Borkmann Jul 03, 2019

bpf, libbpf, smatch: Fix potential NULL pointer dereference



Based on the following report from Smatch, fix the potential NULL
pointer dereference check:

  tools/lib/bpf/libbpf.c:3493
  bpf_prog_load_xattr() warn: variable dereferenced before check 'attr'
  (see line 3483)

  3479 int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr,
  3480                         struct bpf_object **pobj, int *prog_fd)
  3481 {
  3482         struct bpf_object_open_attr open_attr = {
  3483                 .file           = attr->file,
  3484                 .prog_type      = attr->prog_type,
                                         ^^^^^^
  3485         };

At the head of function, it directly access 'attr' without checking
if it's NULL pointer. This patch moves the values assignment after
validating 'attr' and 'attr->file'.

Signed-off-by: Leo Yan <leo.yan@linaro.org>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

parent cdfc7f88

tools/lib/bpf/libbpf.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -3872,10 +3872,7 @@ int bpf_prog_load(const char *file, enum bpf_prog_type type,
		int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr,
		struct bpf_object *pobj, int prog_fd)
		{
		struct bpf_object_open_attr open_attr = {
		.file = attr->file,
		.prog_type = attr->prog_type,
		};
		struct bpf_object_open_attr open_attr = {};
		struct bpf_program prog, first_prog = NULL;
		enum bpf_attach_type expected_attach_type;
		enum bpf_prog_type prog_type;
		@@ -3888,6 +3885,9 @@ int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr,
		if (!attr->file)
		return -EINVAL;

		open_attr.file = attr->file;
		open_attr.prog_type = attr->prog_type;

		obj = bpf_object__open_xattr(&open_attr);
		if (IS_ERR_OR_NULL(obj))
		return -ENOENT;

Admin message