Re: [PATCH bpf-next 2/2] bpftool: Fix UAF in get_delegate_value

[Alexei Starovoitov]

On Mon, Sep 15, 2025 at 10:42 PM Tao Chen <chen.dylane@xxxxxxxxx> wrote:
>
> The return value ret pointer is pointing opts_copy, but opts_copy
> gets freed in get_delegate_value before return, fix this by strdup
> a new buffer.
>
> Fixes: 2d812311c2b2 ("bpftool: Add bpf_token show")
> Signed-off-by: Tao Chen <chen.dylane@xxxxxxxxx>
> ---
>  tools/bpf/bpftool/token.c | 47 ++++++++++++++++++++++-----------------
>  1 file changed, 27 insertions(+), 20 deletions(-)
>
> diff --git a/tools/bpf/bpftool/token.c b/tools/bpf/bpftool/token.c
> index 82b829e44c8..c47256d8038 100644
> --- a/tools/bpf/bpftool/token.c
> +++ b/tools/bpf/bpftool/token.c
> @@ -28,6 +28,12 @@ static bool has_delegate_options(const char *mnt_ops)
>                strstr(mnt_ops, "delegate_attachs");
>  }
>
> +static void free_delegate_value(char *value)
> +{
> +       if (value)
> +               free(value);
> +}
> +
>  static char *get_delegate_value(const char *opts, const char *key)
>  {
>         char *token, *rest, *ret = NULL;
> @@ -40,7 +46,7 @@ static char *get_delegate_value(const char *opts, const char *key)
>                         token = strtok_r(NULL, ",", &rest)) {
>                 if (strncmp(token, key, strlen(key)) == 0 &&
>                     token[strlen(key)] == '=') {
> -                       ret = token + strlen(key) + 1;
> +                       ret = strdup(token + strlen(key) + 1);

Instead of adding more strdup-s
strdup(mntent->mnt_opts) once per cmd/map/prog and
remove another strdrup/free in print_items_per_line().

pw-bot: cr