ucode-mod-bpf: fix missing resource pointer checks
uc_fn_thisval can return NULL when a method is called with a foreign or missing this context. pin, foreach and the iterator next functions dereferenced the result without checking it, crashing the VM. Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
@@ -520,6 +520,9 @@ uc_bpf_map_iter_next(uc_vm_t *vm, size_t nargs)
|
||||
struct uc_bpf_map_iter *iter = uc_fn_thisval("bpf.map_iter");
|
||||
uc_value_t *rv;
|
||||
|
||||
if (!iter)
|
||||
err_return(EINVAL, NULL);
|
||||
|
||||
if (!iter->has_next)
|
||||
return NULL;
|
||||
|
||||
@@ -536,6 +539,9 @@ uc_bpf_map_iter_next_int(uc_vm_t *vm, size_t nargs)
|
||||
uint64_t intval;
|
||||
uc_value_t *rv;
|
||||
|
||||
if (!iter)
|
||||
err_return(EINVAL, NULL);
|
||||
|
||||
if (!iter->has_next)
|
||||
return NULL;
|
||||
|
||||
@@ -561,6 +567,9 @@ uc_bpf_map_foreach(uc_vm_t *vm, size_t nargs)
|
||||
void *key, *next;
|
||||
bool ret = false;
|
||||
|
||||
if (!map)
|
||||
err_return(EINVAL, NULL);
|
||||
|
||||
key = alloca(map->key_size);
|
||||
next = alloca(map->key_size);
|
||||
has_next = !bpf_map_get_next_key(map->fd.fd, NULL, next);
|
||||
@@ -597,6 +606,9 @@ uc_bpf_obj_pin(uc_vm_t *vm, size_t nargs, const char *type)
|
||||
struct uc_bpf_fd *f = uc_fn_thisval(type);
|
||||
uc_value_t *path = uc_fn_arg(0);
|
||||
|
||||
if (!f)
|
||||
err_return(EINVAL, NULL);
|
||||
|
||||
if (ucv_type(path) != UC_STRING)
|
||||
err_return(EINVAL, NULL);
|
||||
|
||||
|
||||
Reference in New Issue
Block a user