Commit cedc12c5 authored by Andreas Ziegler's avatar Andreas Ziegler Committed by Daniel Borkmann
Browse files

libbpf: Add NULL checks to bpf_object__{prev_map,next_map} 



In the current state, an erroneous call to
bpf_object__find_map_by_name(NULL, ...) leads to a segmentation
fault through the following call chain:

  bpf_object__find_map_by_name(obj = NULL, ...)
  -> bpf_object__for_each_map(pos, obj = NULL)
  -> bpf_object__next_map((obj = NULL), NULL)
  -> return (obj = NULL)->maps

While calling bpf_object__find_map_by_name with obj = NULL is
obviously incorrect, this should not lead to a segmentation
fault but rather be handled gracefully.

As __bpf_map__iter already handles this situation correctly, we
can delegate the check for the regular case there and only add
a check in case the prev or next parameter is NULL.

Signed-off-by: default avatarAndreas Ziegler <ziegler.andreas@siemens.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20240703083436.505124-1-ziegler.andreas@siemens.com
parent 02480fe8

tools/lib/bpf/libbpf.c

+2 −2
Original line number Diff line number Diff line
@@ -10375,7 +10375,7 @@ __bpf_map__iter(const struct bpf_map *m, const struct bpf_object *obj, int i) 
struct bpf_map *

bpf_object__next_map(const struct bpf_object *obj, const struct bpf_map *prev)

{

	if (prev == NULL)

	if (prev == NULL && obj != NULL)

		return obj->maps;



	return __bpf_map__iter(prev, obj, 1);
@@ -10384,7 +10384,7 @@ bpf_object__next_map(const struct bpf_object *obj, const struct bpf_map *prev) 
struct bpf_map *

bpf_object__prev_map(const struct bpf_object *obj, const struct bpf_map *next)

{

	if (next == NULL) {

	if (next == NULL && obj != NULL) {

		if (!obj->nr_maps)

			return NULL;

		return obj->maps + obj->nr_maps - 1;