Commit 83c11c17 authored by Alex Dewar's avatar Alex Dewar Committed by Daniel Borkmann

net, sockmap: Don't call bpf_prog_put() on NULL pointer

If bpf_prog_inc_not_zero() fails for skb_parser, then bpf_prog_put() is
called unconditionally on skb_verdict, even though it may be NULL. Fix
and tidy up error path.

Fixes: 743df8b7 ("bpf, sockmap: Check skb_verdict and skb_parser programs explicitly")
Addresses-Coverity-ID: 1497799: Null pointer dereferences (FORWARD_NULL)
Signed-off-by: default avatarAlex Dewar <alex.dewar90@gmail.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarJakub Sitnicki <jakub@cloudflare.com>
Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20201012170952.60750-1-alex.dewar90@gmail.com
parent 8a3feed9
...@@ -238,17 +238,18 @@ static int sock_map_link(struct bpf_map *map, struct sk_psock_progs *progs, ...@@ -238,17 +238,18 @@ static int sock_map_link(struct bpf_map *map, struct sk_psock_progs *progs,
int ret; int ret;
skb_verdict = READ_ONCE(progs->skb_verdict); skb_verdict = READ_ONCE(progs->skb_verdict);
skb_parser = READ_ONCE(progs->skb_parser);
if (skb_verdict) { if (skb_verdict) {
skb_verdict = bpf_prog_inc_not_zero(skb_verdict); skb_verdict = bpf_prog_inc_not_zero(skb_verdict);
if (IS_ERR(skb_verdict)) if (IS_ERR(skb_verdict))
return PTR_ERR(skb_verdict); return PTR_ERR(skb_verdict);
} }
skb_parser = READ_ONCE(progs->skb_parser);
if (skb_parser) { if (skb_parser) {
skb_parser = bpf_prog_inc_not_zero(skb_parser); skb_parser = bpf_prog_inc_not_zero(skb_parser);
if (IS_ERR(skb_parser)) { if (IS_ERR(skb_parser)) {
bpf_prog_put(skb_verdict); ret = PTR_ERR(skb_parser);
return PTR_ERR(skb_parser); goto out_put_skb_verdict;
} }
} }
...@@ -257,7 +258,7 @@ static int sock_map_link(struct bpf_map *map, struct sk_psock_progs *progs, ...@@ -257,7 +258,7 @@ static int sock_map_link(struct bpf_map *map, struct sk_psock_progs *progs,
msg_parser = bpf_prog_inc_not_zero(msg_parser); msg_parser = bpf_prog_inc_not_zero(msg_parser);
if (IS_ERR(msg_parser)) { if (IS_ERR(msg_parser)) {
ret = PTR_ERR(msg_parser); ret = PTR_ERR(msg_parser);
goto out; goto out_put_skb_parser;
} }
} }
...@@ -311,11 +312,12 @@ static int sock_map_link(struct bpf_map *map, struct sk_psock_progs *progs, ...@@ -311,11 +312,12 @@ static int sock_map_link(struct bpf_map *map, struct sk_psock_progs *progs,
out_progs: out_progs:
if (msg_parser) if (msg_parser)
bpf_prog_put(msg_parser); bpf_prog_put(msg_parser);
out: out_put_skb_parser:
if (skb_verdict)
bpf_prog_put(skb_verdict);
if (skb_parser) if (skb_parser)
bpf_prog_put(skb_parser); bpf_prog_put(skb_parser);
out_put_skb_verdict:
if (skb_verdict)
bpf_prog_put(skb_verdict);
return ret; return ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment