Commit afd0be72 authored by Ciara Loftus's avatar Ciara Loftus Committed by Daniel Borkmann
Browse files

libbpf: Fix potential NULL pointer dereference 



Wait until after the UMEM is checked for null to dereference it.

Fixes: 43f1bc1e ("libbpf: Restore umem state after socket create failure")
Signed-off-by: default avatarCiara Loftus <ciara.loftus@intel.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20210408052009.7844-1-ciara.loftus@intel.com
parent 1ffbc7ea

tools/lib/bpf/xsk.c

+3 −2
Original line number Diff line number Diff line
@@ -852,18 +852,19 @@ int xsk_socket__create_shared(struct xsk_socket **xsk_ptr, 
			      struct xsk_ring_cons *comp,

			      const struct xsk_socket_config *usr_config)

{

	bool unmap, rx_setup_done = false, tx_setup_done = false;

	void *rx_map = NULL, *tx_map = NULL;

	struct sockaddr_xdp sxdp = {};

	struct xdp_mmap_offsets off;

	struct xsk_socket *xsk;

	struct xsk_ctx *ctx;

	int err, ifindex;

	bool unmap = umem->fill_save != fill;

	bool rx_setup_done = false, tx_setup_done = false;



	if (!umem || !xsk_ptr || !(rx || tx))

		return -EFAULT;



	unmap = umem->fill_save != fill;



	xsk = calloc(1, sizeof(*xsk));

	if (!xsk)

		return -ENOMEM;