Commit 6903cdae authored by Gaurav Singh's avatar Gaurav Singh Committed by Daniel Borkmann
Browse files

bpf, xdp, samples: Fix null pointer dereference in *_user code 



Memset on the pointer right after malloc can cause a NULL pointer
deference if it failed to allocate memory. A simple fix is to
replace malloc()/memset() pair with a simple call to calloc().

Fixes: 0fca931a ("samples/bpf: program demonstrating access to xdp_rxq_info")
Signed-off-by: default avatarGaurav Singh <gaurav1086@gmail.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
parent c34a06c5

samples/bpf/xdp_monitor_user.c

+2 −6
Original line number Diff line number Diff line
@@ -509,11 +509,8 @@ static void *alloc_rec_per_cpu(int record_size) 
{

	unsigned int nr_cpus = bpf_num_possible_cpus();

	void *array;

	size_t size;



	size = record_size * nr_cpus;

	array = malloc(size);

	memset(array, 0, size);

	array = calloc(nr_cpus, record_size);

	if (!array) {

		fprintf(stderr, "Mem alloc error (nr_cpus:%u)\n", nr_cpus);

		exit(EXIT_FAIL_MEM);
@@ -528,8 +525,7 @@ static struct stats_record *alloc_stats_record(void) 
	int i;



	/* Alloc main stats_record structure */

	rec = malloc(sizeof(*rec));

	memset(rec, 0, sizeof(*rec));

	rec = calloc(1, sizeof(*rec));

	if (!rec) {

		fprintf(stderr, "Mem alloc error\n");

		exit(EXIT_FAIL_MEM);

samples/bpf/xdp_redirect_cpu_user.c

+2 −5
Original line number Diff line number Diff line
@@ -207,11 +207,8 @@ static struct datarec *alloc_record_per_cpu(void) 
{

	unsigned int nr_cpus = bpf_num_possible_cpus();

	struct datarec *array;

	size_t size;



	size = sizeof(struct datarec) * nr_cpus;

	array = malloc(size);

	memset(array, 0, size);

	array = calloc(nr_cpus, sizeof(struct datarec));

	if (!array) {

		fprintf(stderr, "Mem alloc error (nr_cpus:%u)\n", nr_cpus);

		exit(EXIT_FAIL_MEM);
@@ -226,11 +223,11 @@ static struct stats_record *alloc_stats_record(void) 


	size = sizeof(*rec) + n_cpus * sizeof(struct record);

	rec = malloc(size);

	memset(rec, 0, size);

	if (!rec) {

		fprintf(stderr, "Mem alloc error\n");

		exit(EXIT_FAIL_MEM);

	}

	memset(rec, 0, size);

	rec->rx_cnt.cpu    = alloc_record_per_cpu();

	rec->redir_err.cpu = alloc_record_per_cpu();

	rec->kthread.cpu   = alloc_record_per_cpu();

samples/bpf/xdp_rxq_info_user.c

+3 −10
Original line number Diff line number Diff line
@@ -198,11 +198,8 @@ static struct datarec *alloc_record_per_cpu(void) 
{

	unsigned int nr_cpus = bpf_num_possible_cpus();

	struct datarec *array;

	size_t size;



	size = sizeof(struct datarec) * nr_cpus;

	array = malloc(size);

	memset(array, 0, size);

	array = calloc(nr_cpus, sizeof(struct datarec));

	if (!array) {

		fprintf(stderr, "Mem alloc error (nr_cpus:%u)\n", nr_cpus);

		exit(EXIT_FAIL_MEM);
@@ -214,11 +211,8 @@ static struct record *alloc_record_per_rxq(void) 
{

	unsigned int nr_rxqs = bpf_map__def(rx_queue_index_map)->max_entries;

	struct record *array;

	size_t size;



	size = sizeof(struct record) * nr_rxqs;

	array = malloc(size);

	memset(array, 0, size);

	array = calloc(nr_rxqs, sizeof(struct record));

	if (!array) {

		fprintf(stderr, "Mem alloc error (nr_rxqs:%u)\n", nr_rxqs);

		exit(EXIT_FAIL_MEM);
@@ -232,8 +226,7 @@ static struct stats_record *alloc_stats_record(void) 
	struct stats_record *rec;

	int i;



	rec = malloc(sizeof(*rec));

	memset(rec, 0, sizeof(*rec));

	rec = calloc(1, sizeof(struct stats_record));

	if (!rec) {

		fprintf(stderr, "Mem alloc error\n");

		exit(EXIT_FAIL_MEM);

CRA Git | Maintained and supported by SUSTech CRA and CCSE