[PATCH 1/3] bpf: check metadata allocations

[m.dmitrichenko222@gmail.com]

From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>

The BPF translator dereferences buffers returned by malloc and
calloc without checking whether the allocations succeeded. Under
memory pressure this results in a NULL pointer dereference instead of
a controlled translation error.

Check all three allocations before serializing the script name,
aggregate metadata, and foreach metadata.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
---
 bpf-translate.cxx | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/bpf-translate.cxx b/bpf-translate.cxx
index cd1eeaf03..3eab41a95 100644
--- a/bpf-translate.cxx
+++ b/bpf-translate.cxx
@@ -4542,6 +4542,8 @@ output_stapbpf_script_name(BPF_Output &eo, const std::string script_name)
   Elf_Data *data = so->data;
   size_t script_name_len = strlen(script_name.c_str());
   data->d_buf = (void *)malloc(script_name_len + 1);
+  if (!data->d_buf)
+    throw SEMANTIC_ERROR(_("out of memory allocating BPF script name"));
   char *script_name_buf = (char *)data->d_buf;
   script_name.copy(script_name_buf, script_name_len);
   script_name_buf[script_name_len] = '\0';
@@ -4702,6 +4704,8 @@ output_interned_aggregates(BPF_Output &eo, globals& glob)
   unsigned n_aggregates =
     glob.scalar_stats.empty() ? glob.aggregates.size() : glob.aggregates.size() + 1;
   data->d_buf = (void *)calloc(n_aggregates, interned_aggregate_len);
+  if (!data->d_buf)
+    throw SEMANTIC_ERROR(_("out of memory allocating BPF aggregate metadata"));
   data->d_size = interned_aggregate_len * n_aggregates;
   size_t ofs = 0; // XXX after glob.scalar_stats
   if (!glob.scalar_stats.empty())
@@ -4737,6 +4741,8 @@ output_foreach_loop_info(BPF_Output &eo, globals& glob)
     sizeof(uint64_t) * globals::n_foreach_info_fields;
   unsigned n_foreach_loops = glob.foreach_loop_info.size();
   data->d_buf = (void *)calloc(n_foreach_loops, interned_foreach_info_len);
+  if (!data->d_buf)
+    throw SEMANTIC_ERROR(_("out of memory allocating BPF foreach metadata"));
   data->d_size = interned_foreach_info_len * n_foreach_loops;
   size_t ofs = 0;
   uint64_t *ix = (uint64_t *)data->d_buf;
-- 
2.25.1