summaryrefslogtreecommitdiff
path: root/tools/bpf
diff options
context:
space:
mode:
authorEduard Zingerman <eddyz87@gmail.com>2023-03-28 03:47:38 +0300
committerAndrii Nakryiko <andrii@kernel.org>2023-03-28 06:02:15 +0300
commitd08ab82f59d55b0e5acfeb453081278dfc33f232 (patch)
tree6165d102a7aba9310cec8108cd584897bc9aa1a7 /tools/bpf
parent7283137a7622292076dd8b7f3b8b2bb203ce5a14 (diff)
downloadlinux-d08ab82f59d55b0e5acfeb453081278dfc33f232.tar.xz
libbpf: Fix double-free when linker processes empty sections
Double-free error in bpf_linker__free() was reported by James Hilliard. The error is caused by miss-use of realloc() in extend_sec(). The error occurs when two files with empty sections of the same name are linked: - when first file is processed: - extend_sec() calls realloc(dst->raw_data, dst_align_sz) with dst->raw_data == NULL and dst_align_sz == 0; - dst->raw_data is set to a special pointer to a memory block of size zero; - when second file is processed: - extend_sec() calls realloc(dst->raw_data, dst_align_sz) with dst->raw_data == <special pointer> and dst_align_sz == 0; - realloc() "frees" dst->raw_data special pointer and returns NULL; - extend_sec() exits with -ENOMEM, and the old dst->raw_data value is preserved (it is now invalid); - eventually, bpf_linker__free() attempts to free dst->raw_data again. This patch fixes the bug by avoiding -ENOMEM exit for dst_align_sz == 0. The fix was suggested by Andrii Nakryiko <andrii.nakryiko@gmail.com>. Reported-by: James Hilliard <james.hilliard1@gmail.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Tested-by: James Hilliard <james.hilliard1@gmail.com> Link: https://lore.kernel.org/bpf/CADvTj4o7ZWUikKwNTwFq0O_AaX+46t_+Ca9gvWMYdWdRtTGeHQ@mail.gmail.com/ Link: https://lore.kernel.org/bpf/20230328004738.381898-3-eddyz87@gmail.com
Diffstat (limited to 'tools/bpf')
0 files changed, 0 insertions, 0 deletions