On 12/5/21 11:42 AM, Andrii Nakryiko wrote:
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c index e47e8b06cc3d..b9f42e9e9067 100644 --- a/tools/bpf/bpftool/prog.c +++ b/tools/bpf/bpftool/prog.c @@ -1779,12 +1779,14 @@ static int try_loader(struct gen_loader_opts *gen) ctx = alloca(ctx_sz); memset(ctx, 0, ctx_sz); ctx->sz = ctx_sz; - ctx->log_level = 1; - ctx->log_size = log_buf_sz; - log_buf = malloc(log_buf_sz); - if (!log_buf) - return -ENOMEM; - ctx->log_buf = (long) log_buf; + if (verifier_logs) { + ctx->log_level = 1 + 2 + 4; + ctx->log_size = log_buf_sz; + log_buf = malloc(log_buf_sz);if verifier_logs is false, log_buf will now be left uninitialized and passed like that into free(log_buf), crashing or corrupting memory. I've fixed it up by NULL initializaing and pushed to bpf-next.
Indeed. Weird that compiler didn't complain and bpftool didn't crash. Thanks!
