Re: [PATCH bpf-next 2/2] bpftool: Fix UAF in get_delegate_value

[Tao Chen]

在 2025/9/17 01:07, Alexei Starovoitov 写道:
> On Mon, Sep 15, 2025 at 10:42 PM Tao Chen <chen.dylane@xxxxxxxxx> wrote:
> > The return value ret pointer is pointing opts_copy, but opts_copy
> > gets freed in get_delegate_value before return, fix this by strdup
> > a new buffer.
> >
> > Fixes: 2d812311c2b2 ("bpftool: Add bpf_token show")
> > Signed-off-by: Tao Chen <chen.dylane@xxxxxxxxx>
> > ---
> >   tools/bpf/bpftool/token.c | 47 ++++++++++++++++++++++-----------------
> >   1 file changed, 27 insertions(+), 20 deletions(-)
> >
> > diff --git a/tools/bpf/bpftool/token.c b/tools/bpf/bpftool/token.c
> > index 82b829e44c8..c47256d8038 100644
> > --- a/tools/bpf/bpftool/token.c
> > +++ b/tools/bpf/bpftool/token.c
> > @@ -28,6 +28,12 @@ static bool has_delegate_options(const char *mnt_ops)
> >                 strstr(mnt_ops, "delegate_attachs");
> >   }
> >
> > +static void free_delegate_value(char *value)
> > +{
> > +       if (value)
> > +               free(value);
> > +}
> > +
> >   static char *get_delegate_value(const char *opts, const char *key)
> >   {
> >          char *token, *rest, *ret = NULL;
> > @@ -40,7 +46,7 @@ static char *get_delegate_value(const char *opts, const char *key)
> >                          token = strtok_r(NULL, ",", &rest)) {
> >                  if (strncmp(token, key, strlen(key)) == 0 &&
> >                      token[strlen(key)] == '=') {
> > -                       ret = token + strlen(key) + 1;
> > +                       ret = strdup(token + strlen(key) + 1);
>
> Instead of adding more strdup-s
> strdup(mntent->mnt_opts) once per cmd/map/prog and
> remove another strdrup/free in print_items_per_line().
>
> pw-bot: cr

will remove it in v2, thanks.

--
Best Regards
Tao Chen