[PATCH] bpftool: fix potential NULL pointer dereferencing in prog_dump()

[PATCH] bpftool: fix potential NULL pointer dereferencing in prog_dump()

[Amir Mohammadi]

A NULL pointer dereference could occur if ksyms
is not properly checked before usage in the prog_dump() function.

Signed-off-by: Amir Mohammadi <amiremohamadi@yahoo.com>
---
 tools/bpf/bpftool/prog.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 2ff949ea8..8b5300103 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -822,11 +822,12 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
 					printf("%s:\n", sym_name);
 				}
 
-				if (disasm_print_insn(img, lens[i], opcodes,
-						      name, disasm_opt, btf,
-						      prog_linfo, ksyms[i], i,
-						      linum))
-					goto exit_free;
+				if (ksyms)
+					if (disasm_print_insn(img, lens[i], opcodes,
+							      name, disasm_opt, btf,
+							      prog_linfo, ksyms[i], i,
+							      linum))
+						goto exit_free;
 
 				img += lens[i];
 
-- 
2.42.0

Re: [PATCH] bpftool: fix potential NULL pointer dereferencing in prog_dump()

[Quentin Monnet]

2024-11-15 15:15 UTC+0330 ~ Amir Mohammadi <amirmohammadi1999.am@gmail.com>
> A NULL pointer dereference could occur if ksyms
> is not properly checked before usage in the prog_dump() function.
> 
> Signed-off-by: Amir Mohammadi <amiremohamadi@yahoo.com>
> ---
>  tools/bpf/bpftool/prog.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
> index 2ff949ea8..8b5300103 100644
> --- a/tools/bpf/bpftool/prog.c
> +++ b/tools/bpf/bpftool/prog.c
> @@ -822,11 +822,12 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
>  					printf("%s:\n", sym_name);
>  				}
>  
> -				if (disasm_print_insn(img, lens[i], opcodes,
> -						      name, disasm_opt, btf,
> -						      prog_linfo, ksyms[i], i,
> -						      linum))
> -					goto exit_free;
> +				if (ksyms)
> +					if (disasm_print_insn(img, lens[i], opcodes,
> +							      name, disasm_opt, btf,
> +							      prog_linfo, ksyms[i], i,
> +							      linum))
> +						goto exit_free;
>  
>  				img += lens[i];
>  


Thanks! But we don't want to skip dumping the instruction silently if we
don't have ksyms. So we'd need an 'else' block that does the same as if
no JITed functions are found I think, something calling:

	disasm_print_insn(img, lens[i], opcodes, name, disasm_opt, btf,
			  NULL, 0, 0, false)

Fixes: b053b439b72a ("bpf: libbpf: bpftool: Print bpf_line_info during prog dump")

Quentin

[PATCH v2] bpftool: fix potential NULL pointer dereferencing in prog_dump()

[Amir Mohammadi]

A NULL pointer dereference could occur if ksyms
is not properly checked before usage in the prog_dump() function.

Signed-off-by: Amir Mohammadi <amiremohamadi@yahoo.com>
---
 tools/bpf/bpftool/prog.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 2ff949ea8..e71be67f1 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -822,11 +822,18 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
 					printf("%s:\n", sym_name);
 				}
 
-				if (disasm_print_insn(img, lens[i], opcodes,
-						      name, disasm_opt, btf,
-						      prog_linfo, ksyms[i], i,
-						      linum))
-					goto exit_free;
+				if (ksyms) {
+					if (disasm_print_insn(img, lens[i], opcodes,
+							      name, disasm_opt, btf,
+							      prog_linfo, ksyms[i], i,
+							      linum))
+						goto exit_free;
+				} else {
+					if (disasm_print_insn(img, lens[i], opcodes,
+							      name, disasm_opt, btf,
+							      NULL, 0, 0, false))
+						goto exit_free;
+				}
 
 				img += lens[i];
 
-- 
2.42.0

RE: [PATCH v2] bpftool: fix potential NULL pointer dereferencing in prog_dump()

[John Fastabend]

Amir Mohammadi wrote:
> A NULL pointer dereference could occur if ksyms
> is not properly checked before usage in the prog_dump() function.
> 
> Signed-off-by: Amir Mohammadi <amiremohamadi@yahoo.com>
> ---
>  tools/bpf/bpftool/prog.c | 17 ++++++++++++-----
>  1 file changed, 12 insertions(+), 5 deletions(-)

LGTM but still needs a Fixes line.

[PATCH v3] bpftool: fix potential NULL pointer dereferencing in prog_dump()

[Amir Mohammadi]

A NULL pointer dereference could occur if ksyms
is not properly checked before usage in the prog_dump() function.

Fixes: b053b439b72a ("bpf: libbpf: bpftool: Print bpf_line_info during prog dump")
Signed-off-by: Amir Mohammadi <amiremohamadi@yahoo.com>
---
 tools/bpf/bpftool/prog.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 2ff949ea8..e71be67f1 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -822,11 +822,18 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
 					printf("%s:\n", sym_name);
 				}
 
-				if (disasm_print_insn(img, lens[i], opcodes,
-						      name, disasm_opt, btf,
-						      prog_linfo, ksyms[i], i,
-						      linum))
-					goto exit_free;
+				if (ksyms) {
+					if (disasm_print_insn(img, lens[i], opcodes,
+							      name, disasm_opt, btf,
+							      prog_linfo, ksyms[i], i,
+							      linum))
+						goto exit_free;
+				} else {
+					if (disasm_print_insn(img, lens[i], opcodes,
+							      name, disasm_opt, btf,
+							      NULL, 0, 0, false))
+						goto exit_free;
+				}
 
 				img += lens[i];
 
-- 
2.42.0

Re: [PATCH v3] bpftool: fix potential NULL pointer dereferencing in prog_dump()

[Quentin Monnet]

2024-11-21 12:04 UTC+0330 ~ Amir Mohammadi <amirmohammadi1999.am@gmail.com>
> A NULL pointer dereference could occur if ksyms
> is not properly checked before usage in the prog_dump() function.
> 
> Fixes: b053b439b72a ("bpf: libbpf: bpftool: Print bpf_line_info during prog dump")
> Signed-off-by: Amir Mohammadi <amiremohamadi@yahoo.com>

Reviewed-by: Quentin Monnet <qmo@kernel.org>

Thanks!

Re: [PATCH v3] bpftool: fix potential NULL pointer dereferencing in prog_dump()

[John Fastabend]

Quentin Monnet wrote:
> 2024-11-21 12:04 UTC+0330 ~ Amir Mohammadi <amirmohammadi1999.am@gmail.com>
> > A NULL pointer dereference could occur if ksyms
> > is not properly checked before usage in the prog_dump() function.
> > 
> > Fixes: b053b439b72a ("bpf: libbpf: bpftool: Print bpf_line_info during prog dump")
> > Signed-off-by: Amir Mohammadi <amiremohamadi@yahoo.com>
> 
> Reviewed-by: Quentin Monnet <qmo@kernel.org>
> 
> Thanks!

Acked-by: John Fastabend <john.fastabend@gmail.com>

Re: [PATCH v3] bpftool: fix potential NULL pointer dereferencing in prog_dump()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Thu, 21 Nov 2024 12:04:13 +0330 you wrote:
> A NULL pointer dereference could occur if ksyms
> is not properly checked before usage in the prog_dump() function.
> 
> Fixes: b053b439b72a ("bpf: libbpf: bpftool: Print bpf_line_info during prog dump")
> Signed-off-by: Amir Mohammadi <amiremohamadi@yahoo.com>
> ---
>  tools/bpf/bpftool/prog.c | 17 ++++++++++++-----
>  1 file changed, 12 insertions(+), 5 deletions(-)

Here is the summary with links:
  - [v3] bpftool: fix potential NULL pointer dereferencing in prog_dump()
    https://git.kernel.org/bpf/bpf/c/ef3ba8c258ee

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html