| Message ID | 20200614184102.30992-1-gaurav1086@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | [bpf] xdp_monitor_user: Fix null pointer dereference | expand |
Gaurav Singh wrote: > Memset() on the pointer right after malloc() can cause > a null pointer dereference if it failed to allocate memory. > Fix this by replacing malloc/memset with a single calloc(). > > Signed-off-by: Gaurav Singh <gaurav1086@gmail.com> > --- > samples/bpf/xdp_monitor_user.c | 8 ++------ > 1 file changed, 2 insertions(+), 6 deletions(-) > > diff --git a/samples/bpf/xdp_monitor_user.c b/samples/bpf/xdp_monitor_user.c > index dd558cbb2309..ef53b93db573 100644 > --- a/samples/bpf/xdp_monitor_user.c > +++ b/samples/bpf/xdp_monitor_user.c > @@ -509,11 +509,8 @@ static void *alloc_rec_per_cpu(int record_size) > { > unsigned int nr_cpus = bpf_num_possible_cpus(); > void *array; > - size_t size; > > - size = record_size * nr_cpus; > - array = malloc(size); > - memset(array, 0, size); > + array = calloc(nr_cpus, record_size); > if (!array) { > fprintf(stderr, "Mem alloc error (nr_cpus:%u)\n", nr_cpus); > exit(EXIT_FAIL_MEM); > @@ -528,8 +525,7 @@ static struct stats_record *alloc_stats_record(void) > int i; > > /* Alloc main stats_record structure */ > - rec = malloc(sizeof(*rec)); > - memset(rec, 0, sizeof(*rec)); > + rec = calloc(1, sizeof(*rec)); > if (!rec) { > fprintf(stderr, "Mem alloc error\n"); > exit(EXIT_FAIL_MEM); > -- > 2.17.1 > Acked-by: John Fastabend <john.fastabend@gmail.com>
diff --git a/samples/bpf/xdp_monitor_user.c b/samples/bpf/xdp_monitor_user.c index dd558cbb2309..ef53b93db573 100644 --- a/samples/bpf/xdp_monitor_user.c +++ b/samples/bpf/xdp_monitor_user.c @@ -509,11 +509,8 @@ static void *alloc_rec_per_cpu(int record_size) { unsigned int nr_cpus = bpf_num_possible_cpus(); void *array; - size_t size; - size = record_size * nr_cpus; - array = malloc(size); - memset(array, 0, size); + array = calloc(nr_cpus, record_size); if (!array) { fprintf(stderr, "Mem alloc error (nr_cpus:%u)\n", nr_cpus); exit(EXIT_FAIL_MEM); @@ -528,8 +525,7 @@ static struct stats_record *alloc_stats_record(void) int i; /* Alloc main stats_record structure */ - rec = malloc(sizeof(*rec)); - memset(rec, 0, sizeof(*rec)); + rec = calloc(1, sizeof(*rec)); if (!rec) { fprintf(stderr, "Mem alloc error\n"); exit(EXIT_FAIL_MEM);
Memset() on the pointer right after malloc() can cause a null pointer dereference if it failed to allocate memory. Fix this by replacing malloc/memset with a single calloc(). Signed-off-by: Gaurav Singh <gaurav1086@gmail.com> --- samples/bpf/xdp_monitor_user.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)