diff --git a/backport-libbpf-Add-NULL-checks-to-bpf_object__perv_map_and_n.patch b/backport-libbpf-Add-NULL-checks-to-bpf_object__perv_map_and_n.patch new file mode 100644 index 0000000000000000000000000000000000000000..fb8a1ce8a70ad722a5fc193ac198f122d716173d --- /dev/null +++ b/backport-libbpf-Add-NULL-checks-to-bpf_object__perv_map_and_n.patch @@ -0,0 +1,51 @@ +From 1867490d8fc635c552569d51c48debff588d2191 Mon Sep 17 00:00:00 2001 +From: Andreas Ziegler +Date: Wed, 3 Jul 2024 10:34:36 +0200 +Subject: [PATCH] libbpf: Add NULL checks to bpf_object__{prev_map,next_map} + +In the current state, an erroneous call to +bpf_object__find_map_by_name(NULL, ...) leads to a segmentation +fault through the following call chain: + + bpf_object__find_map_by_name(obj = NULL, ...) + -> bpf_object__for_each_map(pos, obj = NULL) + -> bpf_object__next_map((obj = NULL), NULL) + -> return (obj = NULL)->maps + +While calling bpf_object__find_map_by_name with obj = NULL is +obviously incorrect, this should not lead to a segmentation +fault but rather be handled gracefully. + +As __bpf_map__iter already handles this situation correctly, we +can delegate the check for the regular case there and only add +a check in case the prev or next parameter is NULL. + +Signed-off-by: Andreas Ziegler +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20240703083436.505124-1-ziegler.andreas@siemens.com +--- + src/libbpf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/libbpf.c b/src/libbpf.c +index 4a28fac49..30f121754 100644 +--- a/src/libbpf.c ++++ b/src/libbpf.c +@@ -10375,7 +10375,7 @@ __bpf_map__iter(const struct bpf_map *m, const struct bpf_object *obj, int i) + struct bpf_map * + bpf_object__next_map(const struct bpf_object *obj, const struct bpf_map *prev) + { +- if (prev == NULL) ++ if (prev == NULL && obj != NULL) + return obj->maps; + + return __bpf_map__iter(prev, obj, 1); +@@ -10384,7 +10384,7 @@ bpf_object__next_map(const struct bpf_object *obj, const struct bpf_map *prev) + struct bpf_map * + bpf_object__prev_map(const struct bpf_object *obj, const struct bpf_map *next) + { +- if (next == NULL) { ++ if (next == NULL && obj != NULL) { + if (!obj->nr_maps) + return NULL; + return obj->maps + obj->nr_maps - 1; diff --git a/libbpf.spec b/libbpf.spec index dde81baccb6b15524d2cf8b82de39bc667f74c70..d9aaaa6e28441a8a264913bb95450523b4393fb3 100644 --- a/libbpf.spec +++ b/libbpf.spec @@ -4,7 +4,7 @@ Name: %{githubname} Version: %{githubver} -Release: 3 +Release: 4 Summary: Libbpf library License: LGPLv2 or BSD @@ -18,6 +18,7 @@ Patch0001: backport-libbpf-Ensure-libbpf-always-opens-files-with-O_CLOEX.pa Patch0002: backport-libbpf-Set-close-on-exec-flag-on-gzopen.patch Patch0003: backport-libbpf-Fix-NULL-pointer-dereference-in_bpf_object__c.patch Patch0004: backport-libbpf-Free-btf_vmlinux-when-closing-bpf_object.patch +Patch0005: backport-libbpf-Add-NULL-checks-to-bpf_object__perv_map_and_n.patch # This package supersedes libbpf from kernel-tools, # which has default Epoch: 0. By having Epoch: 1 @@ -70,6 +71,10 @@ developing applications that use %{name} %{_libdir}/libbpf.a %changelog +* Thu Aug 29 2024 jinzhiguang 2:1.2.2-4 +- backport patch from upstream: + backport-libbpf-Add-NULL-checks-to-bpf_object__perv_map_and_n.patch + * Fri May 10 2024 jinzhiguang 2:1.2.2-3 - backport patch from upstream: backport-libbpf-Free-btf_vmlinux-when-closing-bpf_object.patch