From: Shung-Hsi Yu Date: Wed, 12 Oct 2022 02:23:53 +0000 (+0800) Subject: libbpf: Fix null-pointer dereference in find_prog_by_sec_insn() X-Git-Tag: v6.6.7~3913^2~413^2~3^2 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=d0d382f95a9270dcf803539d6781d6bd67e3f5b2;p=platform%2Fkernel%2Flinux-starfive.git libbpf: Fix null-pointer dereference in find_prog_by_sec_insn() When there are no program sections, obj->programs is left unallocated, and find_prog_by_sec_insn()'s search lands on &obj->programs[0] == NULL, and will cause null-pointer dereference in the following access to prog->sec_idx. Guard the search with obj->nr_programs similar to what's being done in __bpf_program__iter() to prevent null-pointer access from happening. Fixes: db2b8b06423c ("libbpf: Support CO-RE relocations for multi-prog sections") Signed-off-by: Shung-Hsi Yu Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20221012022353.7350-4-shung-hsi.yu@suse.com --- diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c index 29e9df0..8c3f236 100644 --- a/tools/lib/bpf/libbpf.c +++ b/tools/lib/bpf/libbpf.c @@ -4115,6 +4115,9 @@ static struct bpf_program *find_prog_by_sec_insn(const struct bpf_object *obj, int l = 0, r = obj->nr_programs - 1, m; struct bpf_program *prog; + if (!obj->nr_programs) + return NULL; + while (l < r) { m = l + (r - l + 1) / 2; prog = &obj->programs[m];