[PATCH] bpftool: check for NULL ptr of btf in codegen_subskel_datasecs

[PATCH] bpftool: check for NULL ptr of btf in codegen_subskel_datasecs

[Ma Ke]

bpf_object__btf() can return NULL value.  If bpf_object__btf returns null,
do not progress through codegen_subskel_datasecs(). This avoids a null ptr
dereference.

Found by code review, complie tested only.

Cc: stable@vger.kernel.org
Fixes: 00389c58ffe9 ("bpftool: Add support for subskeletons")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
---
 tools/bpf/bpftool/gen.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
index 5a4d3240689e..7ce62f280310 100644
--- a/tools/bpf/bpftool/gen.c
+++ b/tools/bpf/bpftool/gen.c
@@ -334,6 +334,9 @@ static int codegen_subskel_datasecs(struct bpf_object *obj, const char *obj_name
 	const char *sec_name, *var_name;
 	__u32 var_type_id;
 
+	if (!btf)
+		return -EINVAL;
+
 	d = btf_dump__new(btf, codegen_btf_dump_printf, NULL, NULL);
 	if (!d)
 		return -errno;
-- 
2.25.1

Re: [PATCH] bpftool: check for NULL ptr of btf in codegen_subskel_datasecs

[Yonghong Song]

On 8/21/24 6:31 AM, Ma Ke wrote:
> bpf_object__btf() can return NULL value.  If bpf_object__btf returns null,
> do not progress through codegen_subskel_datasecs(). This avoids a null ptr
> dereference.
>
> Found by code review, complie tested only.

Do you have a real case to show null ptr reference here?
Code review and compile test are not enough. You should have
a real reproducible case before you send the patch.

For this particular case, we have check

         btf = bpf_object__btf(obj);
         if (!btf) {
                 err = -1;
                 p_err("need btf type information for %s", obj_name);
                 goto out;
         }

which ensures that btf is available before codegen for subskeleton,
so what you described won't happen in practice.
  

>
> Cc: stable@vger.kernel.org
> Fixes: 00389c58ffe9 ("bpftool: Add support for subskeletons")
> Signed-off-by: Ma Ke <make24@iscas.ac.cn>
> ---
>   tools/bpf/bpftool/gen.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
> index 5a4d3240689e..7ce62f280310 100644
> --- a/tools/bpf/bpftool/gen.c
> +++ b/tools/bpf/bpftool/gen.c
> @@ -334,6 +334,9 @@ static int codegen_subskel_datasecs(struct bpf_object *obj, const char *obj_name
>   	const char *sec_name, *var_name;
>   	__u32 var_type_id;
>   
> +	if (!btf)
> +		return -EINVAL;
> +
>   	d = btf_dump__new(btf, codegen_btf_dump_printf, NULL, NULL);
>   	if (!d)
>   		return -errno;