diff options
author | Eduard Zingerman <eddyz87@gmail.com> | 2023-03-28 03:47:38 +0300 |
---|---|---|
committer | Andrii Nakryiko <andrii@kernel.org> | 2023-03-27 20:02:15 -0700 |
commit | d08ab82f59d55b0e5acfeb453081278dfc33f232 (patch) | |
tree | 6165d102a7aba9310cec8108cd584897bc9aa1a7 /tools/testing/selftests/bpf/prog_tests/verifier.c | |
parent | 7283137a7622292076dd8b7f3b8b2bb203ce5a14 (diff) |
libbpf: Fix double-free when linker processes empty sections
Double-free error in bpf_linker__free() was reported by James Hilliard.
The error is caused by miss-use of realloc() in extend_sec().
The error occurs when two files with empty sections of the same name
are linked:
- when first file is processed:
- extend_sec() calls realloc(dst->raw_data, dst_align_sz)
with dst->raw_data == NULL and dst_align_sz == 0;
- dst->raw_data is set to a special pointer to a memory block of
size zero;
- when second file is processed:
- extend_sec() calls realloc(dst->raw_data, dst_align_sz)
with dst->raw_data == <special pointer> and dst_align_sz == 0;
- realloc() "frees" dst->raw_data special pointer and returns NULL;
- extend_sec() exits with -ENOMEM, and the old dst->raw_data value
is preserved (it is now invalid);
- eventually, bpf_linker__free() attempts to free dst->raw_data again.
This patch fixes the bug by avoiding -ENOMEM exit for dst_align_sz == 0.
The fix was suggested by Andrii Nakryiko <andrii.nakryiko@gmail.com>.
Reported-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Tested-by: James Hilliard <james.hilliard1@gmail.com>
Link: https://lore.kernel.org/bpf/CADvTj4o7ZWUikKwNTwFq0O_AaX+46t_+Ca9gvWMYdWdRtTGeHQ@mail.gmail.com/
Link: https://lore.kernel.org/bpf/20230328004738.381898-3-eddyz87@gmail.com
Diffstat (limited to 'tools/testing/selftests/bpf/prog_tests/verifier.c')
0 files changed, 0 insertions, 0 deletions