[v2] bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure

[PATH v2] bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure

Posted by chenyuan 3 months, 3 weeks ago

From: chenyuan <chenyuan@kylinos.cn>

In function dump_xx_nlmsg(), when realloc() fails to allocate memory,
the original pointer to the buffer is overwritten with NULL. This causes
a memory leak because the previously allocated buffer becomes unreachable
without being freed.

Fix: 7900efc19214 ("tools/bpf: bpftool: improve output format for bpftool net")
Signed-off-by: chenyuan <chenyuan@kylinos.cn>
---
 tools/bpf/bpftool/net.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c
index 64f958f437b0..1abedfe6f33f 100644
--- a/tools/bpf/bpftool/net.c
+++ b/tools/bpf/bpftool/net.c
@@ -366,17 +366,18 @@ static int dump_link_nlmsg(void *cookie, void *msg, struct nlattr **tb)
 {
 	struct bpf_netdev_t *netinfo = cookie;
 	struct ifinfomsg *ifinfo = msg;
+	struct ip_devname_ifindex *tmp;
 
 	if (netinfo->filter_idx > 0 && netinfo->filter_idx != ifinfo->ifi_index)
 		return 0;
 
 	if (netinfo->used_len == netinfo->array_len) {
-		netinfo->devices = realloc(netinfo->devices,
-			(netinfo->array_len + 16) *
+		tmp = realloc(netinfo->devices, (netinfo->array_len + 16) *
 			sizeof(struct ip_devname_ifindex));
-		if (!netinfo->devices)
+		if (!tmp)
 			return -ENOMEM;
 
+		netinfo->devices = tmp;
 		netinfo->array_len += 16;
 	}
 	netinfo->devices[netinfo->used_len].ifindex = ifinfo->ifi_index;
@@ -395,6 +396,7 @@ static int dump_class_qdisc_nlmsg(void *cookie, void *msg, struct nlattr **tb)
 {
 	struct bpf_tcinfo_t *tcinfo = cookie;
 	struct tcmsg *info = msg;
+	struct tc_kind_handle *tmp;
 
 	if (tcinfo->is_qdisc) {
 		/* skip clsact qdisc */
@@ -406,11 +408,12 @@ static int dump_class_qdisc_nlmsg(void *cookie, void *msg, struct nlattr **tb)
 	}
 
 	if (tcinfo->used_len == tcinfo->array_len) {
-		tcinfo->handle_array = realloc(tcinfo->handle_array,
+		tmp = realloc(tcinfo->handle_array,
 			(tcinfo->array_len + 16) * sizeof(struct tc_kind_handle));
-		if (!tcinfo->handle_array)
+		if (!tmp)
 			return -ENOMEM;
 
+		tcinfo->handle_array = tmp;
 		tcinfo->array_len += 16;
 	}
 	tcinfo->handle_array[tcinfo->used_len].handle = info->tcm_handle;
-- 
2.25.1

Re: [PATH v2] bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure

Posted by Alexei Starovoitov 3 months, 3 weeks ago

On Wed, Jun 18, 2025 at 11:57 PM chenyuan <chenyuan_fl@163.com> wrote:
>
> From: chenyuan <chenyuan@kylinos.cn>
>
> In function dump_xx_nlmsg(), when realloc() fails to allocate memory,
> the original pointer to the buffer is overwritten with NULL. This causes
> a memory leak because the previously allocated buffer becomes unreachable
> without being freed.
>
> Fix: 7900efc19214 ("tools/bpf: bpftool: improve output format for bpftool net")
> Signed-off-by: chenyuan <chenyuan@kylinos.cn>

SOB and Author field should have full name as "First Last".

pw-bot: cr

[PATCH v3] bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure

Posted by Yuan Chen 3 months, 3 weeks ago

From: Yuan Chen <chenyuan@kylinos.cn>

In function dump_xx_nlmsg(), when realloc() fails to allocate memory,
the original pointer to the buffer is overwritten with NULL. This causes
a memory leak because the previously allocated buffer becomes unreachable
without being freed.

Fixes: 7900efc19214 ("tools/bpf: bpftool: improve output format for bpftool net")
Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
---
 tools/bpf/bpftool/net.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c
index 64f958f437b0..cfc6f944f7c3 100644
--- a/tools/bpf/bpftool/net.c
+++ b/tools/bpf/bpftool/net.c
@@ -366,17 +366,18 @@ static int dump_link_nlmsg(void *cookie, void *msg, struct nlattr **tb)
 {
 	struct bpf_netdev_t *netinfo = cookie;
 	struct ifinfomsg *ifinfo = msg;
+	struct ip_devname_ifindex *tmp;
 
 	if (netinfo->filter_idx > 0 && netinfo->filter_idx != ifinfo->ifi_index)
 		return 0;
 
 	if (netinfo->used_len == netinfo->array_len) {
-		netinfo->devices = realloc(netinfo->devices,
-			(netinfo->array_len + 16) *
-			sizeof(struct ip_devname_ifindex));
-		if (!netinfo->devices)
+		tmp = realloc(netinfo->devices,
+			(netinfo->array_len + 16) * sizeof(struct ip_devname_ifindex));
+		if (!tmp)
 			return -ENOMEM;
 
+		netinfo->devices = tmp;
 		netinfo->array_len += 16;
 	}
 	netinfo->devices[netinfo->used_len].ifindex = ifinfo->ifi_index;
@@ -395,6 +396,7 @@ static int dump_class_qdisc_nlmsg(void *cookie, void *msg, struct nlattr **tb)
 {
 	struct bpf_tcinfo_t *tcinfo = cookie;
 	struct tcmsg *info = msg;
+	struct tc_kind_handle *tmp;
 
 	if (tcinfo->is_qdisc) {
 		/* skip clsact qdisc */
@@ -406,11 +408,12 @@ static int dump_class_qdisc_nlmsg(void *cookie, void *msg, struct nlattr **tb)
 	}
 
 	if (tcinfo->used_len == tcinfo->array_len) {
-		tcinfo->handle_array = realloc(tcinfo->handle_array,
+		tmp = realloc(tcinfo->handle_array,
 			(tcinfo->array_len + 16) * sizeof(struct tc_kind_handle));
-		if (!tcinfo->handle_array)
+		if (!tmp)
 			return -ENOMEM;
 
+		tcinfo->handle_array = tmp;
 		tcinfo->array_len += 16;
 	}
 	tcinfo->handle_array[tcinfo->used_len].handle = info->tcm_handle;
-- 
2.25.1

Re: [PATCH v3] bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure

Posted by Quentin Monnet 3 months, 2 weeks ago

2025-06-20 09:21 UTC+0800 ~ Yuan Chen <chenyuan_fl@163.com>
> From: Yuan Chen <chenyuan@kylinos.cn>
> 
> In function dump_xx_nlmsg(), when realloc() fails to allocate memory,
> the original pointer to the buffer is overwritten with NULL. This causes
> a memory leak because the previously allocated buffer becomes unreachable
> without being freed.
> 
> Fixes: 7900efc19214 ("tools/bpf: bpftool: improve output format for bpftool net")
> Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>

Reviewed-by: Quentin Monnet <qmo@kernel.org>

Thanks!

Re: [PATH v2] bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure

Posted by Quentin Monnet 3 months, 3 weeks ago

2025-06-19 14:57 UTC+0800 ~ chenyuan <chenyuan_fl@163.com>
> From: chenyuan <chenyuan@kylinos.cn>
> 
> In function dump_xx_nlmsg(), when realloc() fails to allocate memory,
> the original pointer to the buffer is overwritten with NULL. This causes
> a memory leak because the previously allocated buffer becomes unreachable
> without being freed.
> 
> Fix: 7900efc19214 ("tools/bpf: bpftool: improve output format for bpftool net")


Fixes: 7900efc19214 ("tools/bpf: bpftool: improve output format for bpftool net")

(Not "Fix:")


> Signed-off-by: chenyuan <chenyuan@kylinos.cn>
> ---
>  tools/bpf/bpftool/net.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
> 
> diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c
> index 64f958f437b0..1abedfe6f33f 100644
> --- a/tools/bpf/bpftool/net.c
> +++ b/tools/bpf/bpftool/net.c
> @@ -366,17 +366,18 @@ static int dump_link_nlmsg(void *cookie, void *msg, struct nlattr **tb)
>  {
>  	struct bpf_netdev_t *netinfo = cookie;
>  	struct ifinfomsg *ifinfo = msg;
> +	struct ip_devname_ifindex *tmp;
>  
>  	if (netinfo->filter_idx > 0 && netinfo->filter_idx != ifinfo->ifi_index)
>  		return 0;
>  
>  	if (netinfo->used_len == netinfo->array_len) {
> -		netinfo->devices = realloc(netinfo->devices,
> -			(netinfo->array_len + 16) *
> +		tmp = realloc(netinfo->devices, (netinfo->array_len + 16) *
>  			sizeof(struct ip_devname_ifindex));


Nit: Can you please break the line after the comma rather than after the '*' sign,
like in dump_class_qdisc_nlmsg()?

Otherwise looks good, thanks for this! You can add my tag for v3:

Reviewed-by: Quentin Monnet <qmo@kernel.org>