diff options
| author | Alexei Starovoitov <ast@kernel.org> | 2019-11-26 15:01:06 -0800 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2019-11-27 01:04:47 +0100 |
| commit | d0f010434124598988ba1c97fbb0e4e820ff5d8c (patch) | |
| tree | 89d190812932b184d17d6848bf24635dea2680c9 /kernel | |
| parent | a95069ecb7092d03b2ea1c39ee04514fe9627540 (diff) | |
| download | lwn-d0f010434124598988ba1c97fbb0e4e820ff5d8c.tar.gz lwn-d0f010434124598988ba1c97fbb0e4e820ff5d8c.zip | |
bpf: Fix static checker warning
kernel/bpf/btf.c:4023 btf_distill_func_proto()
error: potentially dereferencing uninitialized 't'.
kernel/bpf/btf.c
4012 nargs = btf_type_vlen(func);
4013 if (nargs >= MAX_BPF_FUNC_ARGS) {
4014 bpf_log(log,
4015 "The function %s has %d arguments. Too many.\n",
4016 tname, nargs);
4017 return -EINVAL;
4018 }
4019 ret = __get_type_size(btf, func->type, &t);
^^
t isn't initialized for the first -EINVAL return
This is unlikely path, since BTF should have been validated at this point.
Fix it by returning 'void' BTF.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20191126230106.237179-1-ast@kernel.org
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/btf.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 40efde5eedcb..bd5e11881ba3 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -3976,8 +3976,10 @@ static int __get_type_size(struct btf *btf, u32 btf_id, t = btf_type_by_id(btf, btf_id); while (t && btf_type_is_modifier(t)) t = btf_type_by_id(btf, t->type); - if (!t) + if (!t) { + *bad_type = btf->types[0]; return -EINVAL; + } if (btf_type_is_ptr(t)) /* kernel size of pointer. Not BPF's size of pointer*/ return sizeof(void *); |