bpf: Initialize storage pointers to NULL to prevent freeing garbage pointer

Local storage array isn't initialized, so if cgroup storage allocation fails for BPF_CGROUP_STORAGE_SHARED, error handling code will attempt to free uninitialized pointer for BPF_CGROUP_STORAGE_PERCPU storage type. Avoid this by always initializing storage pointers to NULLs.

Andrii Nakryiko committed 6 years ago

Commit 62039c31 parent 93e5fbb1 file · +2 −2Browse files

Showing the changes to kernel (1 of 1 file). Show all

Unified · Split

kernel/bpf/cgroup.c+2−2

@@ -302,8 +302,8 @@ int __cgroup_bpf_attach(struct cgroup cgrp, struct bpf_prog prog, · 301 unmodified lines
302	u32 saved_flags = (flags & (BPF_F_ALLOW_OVERRIDE \| BPF_F_ALLOW_MULTI));	302	u32 saved_flags = (flags & (BPF_F_ALLOW_OVERRIDE \| BPF_F_ALLOW_MULTI));
303	struct list_head *progs = &cgrp->bpf.progs[type];	303	struct list_head *progs = &cgrp->bpf.progs[type];
304	struct bpf_prog *old_prog = NULL;	304	struct bpf_prog *old_prog = NULL;
305	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE],	305	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
306	*old_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {NULL};	306	struct bpf_cgroup_storage *old_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
307	struct bpf_prog_list pl, replace_pl = NULL;	307	struct bpf_prog_list pl, replace_pl = NULL;
308	enum bpf_cgroup_storage_type stype;	308	enum bpf_cgroup_storage_type stype;
309	int err;	309	int err;