We found that function btf_dump__dump_type_data can be called by the user
as an api, but in this function, the `opts` parameter may be used as a
null pointer, because OPTS_VALID can't properly prevent opts used as null
pointers during verification. Therefore, we fix this problem through this
modification.

This modification has no impact on other places where OPTS_VALID has been
used.

Fixes: 2ce8450ef5a3 ("libbpf: add bpf_object__open_{file, mem} w/ extensible opts")
Signed-off-by: Xin Liu <liuxin350@huawei.com>
---
 tools/lib/bpf/libbpf_internal.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/lib/bpf/libbpf_internal.h b/tools/lib/bpf/libbpf_internal.h
index 377642ff51fc..29d3267ba56a 100644
--- a/tools/lib/bpf/libbpf_internal.h
+++ b/tools/lib/bpf/libbpf_internal.h
@@ -294,7 +294,7 @@ static inline bool libbpf_validate_opts(const char *opts,
 }
 
 #define OPTS_VALID(opts, type)						      \
-	(!(opts) || libbpf_validate_opts((const char *)opts,		      \
+	((opts) && libbpf_validate_opts((const char *)opts,		      \
 					 offsetofend(struct type,	      \
 						     type##__last_field),     \
 					 (opts)->sz, #type))
-- 
2.33.0

Hi Xin,

On Wed, Sep 14, 2022 at 5:35 AM Xin Liu <liuxin350@huawei.com> wrote:
>
> We found that function btf_dump__dump_type_data can be called by the user
> as an api, but in this function, the `opts` parameter may be used as a
> null pointer, because OPTS_VALID can't properly prevent opts used as null
> pointers during verification. Therefore, we fix this problem through this
> modification.
>
> This modification has no impact on other places where OPTS_VALID has been
> used.

I think this is a bug of btf_dump__dump_type_data(), not OPTS_VALID.
It seems allowing OPTS_VALID to accept NULL is the intended behavior.

>
[...]
>

On Wed, 14 Sep 2022 at 6:15:39 PM Hao Luo <haoluo@google.com> wrote:
> Hi Xin,
>
> On Wed, Sep 14, 2022 at 5:35 AM Xin Liu <liuxin350@huawei.com> wrote:
> >
> > We found that function btf_dump__dump_type_data can be called by the user
> > as an api, but in this function, the `opts` parameter may be used as a
> > null pointer, because OPTS_VALID can't properly prevent opts used as null
> > pointers during verification. Therefore, we fix this problem through this
> > modification.
> >
> > This modification has no impact on other places where OPTS_VALID has been
> > used.
>
> I think this is a bug of btf_dump__dump_type_data(), not OPTS_VALID.
> It seems allowing OPTS_VALID to accept NULL is the intended behavior.
>
> >
> [...]
> >

Thank you for your review.
You are right, OPTS_GET should be used to get data from opts and determine if
opts is NULL. Here I'll use OPTS_GET to fix the bug in the v2 version.