Re: [PATCH bpf-next 2/2] bpftool: Fix UAF in get_delegate_value

[Tao Chen <chen.dylane@linux.dev>]

在 2025/9/17 01:07, Alexei Starovoitov 写道:
> On Mon, Sep 15, 2025 at 10:42 PM Tao Chen <chen.dylane@linux.dev> wrote:
>>
>> The return value ret pointer is pointing opts_copy, but opts_copy
>> gets freed in get_delegate_value before return, fix this by strdup
>> a new buffer.
>>
>> Fixes: 2d812311c2b2 ("bpftool: Add bpf_token show")
>> Signed-off-by: Tao Chen <chen.dylane@linux.dev>
>> ---
>>   tools/bpf/bpftool/token.c | 47 ++++++++++++++++++++++-----------------
>>   1 file changed, 27 insertions(+), 20 deletions(-)
>>
>> diff --git a/tools/bpf/bpftool/token.c b/tools/bpf/bpftool/token.c
>> index 82b829e44c8..c47256d8038 100644
>> --- a/tools/bpf/bpftool/token.c
>> +++ b/tools/bpf/bpftool/token.c
>> @@ -28,6 +28,12 @@ static bool has_delegate_options(const char *mnt_ops)
>>                 strstr(mnt_ops, "delegate_attachs");
>>   }
>>
>> +static void free_delegate_value(char *value)
>> +{
>> +       if (value)
>> +               free(value);
>> +}
>> +
>>   static char *get_delegate_value(const char *opts, const char *key)
>>   {
>>          char *token, *rest, *ret = NULL;
>> @@ -40,7 +46,7 @@ static char *get_delegate_value(const char *opts, const char *key)
>>                          token = strtok_r(NULL, ",", &rest)) {
>>                  if (strncmp(token, key, strlen(key)) == 0 &&
>>                      token[strlen(key)] == '=') {
>> -                       ret = token + strlen(key) + 1;
>> +                       ret = strdup(token + strlen(key) + 1);
> 
> Instead of adding more strdup-s
> strdup(mntent->mnt_opts) once per cmd/map/prog and
> remove another strdrup/free in print_items_per_line().
> 
> pw-bot: cr

will remove it in v2, thanks.

-- 
Best Regards
Tao Chen