[PATCH] samples/bpf: hbm: check the return value of fopen()

[PATCH] samples/bpf: hbm: check the return value of fopen()

[zhangchujun]

run_bpf_prog() passes the FILE pointer returned by fopen() directly
to fscanf() without checking it for NULL.  When the file cannot be
opened (e.g. the network interface is not named eth0), fscanf()
dereferences NULL and the program crashes.

Add a NULL check on the return value of fopen() at both call sites
and exit with an error message on failure.

Signed-off-by: zhangchujun <zhangchujun@cmss.chinamobile.com>
---
 samples/bpf/hbm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/samples/bpf/hbm.c b/samples/bpf/hbm.c
index fc88d4dbdf48..23304b988a45 100644
--- a/samples/bpf/hbm.c
+++ b/samples/bpf/hbm.c
@@ -226,6 +226,8 @@ static int run_bpf_prog(char *prog, int cg_id)
 			do_error("gettimeofday failed", true);
 		t_last = t0;
 		fin = fopen("/sys/class/net/eth0/statistics/tx_bytes", "r");
+		if (!fin)
+			do_error("fopen fails", true);
 		if (fscanf(fin, "%llu", &last_eth_tx_bytes) != 1)
 			do_error("fscanf fails", false);
 		fclose(fin);
@@ -245,6 +247,8 @@ static int run_bpf_prog(char *prog, int cg_id)
 			t_last = t_new;
 			fin = fopen("/sys/class/net/eth0/statistics/tx_bytes",
 				    "r");
+			if (!fin)
+				do_error("fopen fails", true);
 			if (fscanf(fin, "%llu", &new_eth_tx_bytes) != 1)
 				do_error("fscanf fails", false);
 			fclose(fin);

Re: [PATCH] samples/bpf: hbm: check the return value of fopen()

[Alexei Starovoitov]

On Tue, Nov 03, 2026 at 07:53 PM zhangchujun <zhangchujun@cmss.chinamobile.com> wrote:
> run_bpf_prog() passes the FILE pointer returned by fopen() directly
> to fscanf() without checking it for NULL.  When the file cannot be
> opened (e.g. the network interface is not named eth0), fscanf()
> dereferences NULL and the program crashes.

samples/bpf/ are dead.
'hbm -w' works with eth0 only. Usage() says so.
Without eth0 it fails with and without this patch.
I don't think we need this patch.

pw-bot: cr