Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

libbpf: Fix potential NULL pointer dereference

Wait until after the UMEM is checked for null to dereference it.

Fixes: 43f1bc1efff1 ("libbpf: Restore umem state after socket create failure")
Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20210408052009.7844-1-ciara.loftus@intel.com

authored by

Ciara Loftus and committed by
Daniel Borkmann
afd0be72 1ffbc7ea

+3 -2
+3 -2
tools/lib/bpf/xsk.c
··· 852 852 struct xsk_ring_cons *comp, 853 853 const struct xsk_socket_config *usr_config) 854 854 { 855 + bool unmap, rx_setup_done = false, tx_setup_done = false; 855 856 void *rx_map = NULL, *tx_map = NULL; 856 857 struct sockaddr_xdp sxdp = {}; 857 858 struct xdp_mmap_offsets off; 858 859 struct xsk_socket *xsk; 859 860 struct xsk_ctx *ctx; 860 861 int err, ifindex; 861 - bool unmap = umem->fill_save != fill; 862 - bool rx_setup_done = false, tx_setup_done = false; 863 862 864 863 if (!umem || !xsk_ptr || !(rx || tx)) 865 864 return -EFAULT; 865 + 866 + unmap = umem->fill_save != fill; 866 867 867 868 xsk = calloc(1, sizeof(*xsk)); 868 869 if (!xsk)