[PATCH 2/3] stapbpf: check map key allocations

[m.dmitrichenko222@gmail.com]

From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>

The BPF interpreter copies map keys into buffers returned by malloc
without checking for allocation failure. A NULL return is consequently
passed to memcpy.

Abort with a diagnostic when a map key buffer cannot be allocated,
matching the existing handling for map value and printf argument
allocations.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
---
 stapbpf/bpfinterp.cxx | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/stapbpf/bpfinterp.cxx b/stapbpf/bpfinterp.cxx
index 1be199f77..be8d1fdda 100644
--- a/stapbpf/bpfinterp.cxx
+++ b/stapbpf/bpfinterp.cxx
@@ -148,6 +148,7 @@ foreach_state_add(const foreach_info &fi, foreach_state &s,
 
   // copy and save key
   uint64_t *kp2 = (uint64_t *)malloc(fi.keysize);
+  if (!kp2) stapbpf_abort("map key allocation failed");
   memcpy(kp2, kp, fi.keysize);
   s.keys.push_back(kp2);
 
@@ -228,6 +229,7 @@ convert_key(const foreach_info &fi,
   // handle string composite keys being passed as pointers
   // allocate correctly sized buffer and store it in map_values:
   uint64_t *lookup_tmp = (uint64_t*)malloc(fi.keysize);
+  if (!lookup_tmp) stapbpf_abort("map key allocation failed");
   memcpy(lookup_tmp, kp, fi.keysize);
   map_values.push_back(lookup_tmp);
   *next_kp = reinterpret_cast<uint64_t>(map_values.back());
@@ -405,6 +407,7 @@ map_get_next_key(int fd_idx, int64_t key, int64_t next_key,
         {
           // allocate correctly sized buffer and store it in map_values:
           uint64_t *lookup_tmp = (uint64_t*)malloc(fi.keysize);
+          if (!lookup_tmp) stapbpf_abort("map key allocation failed");
           memcpy(lookup_tmp, _n, fi.keysize);
           map_values.push_back(lookup_tmp);
           *(uint64_t *)next_key =
-- 
2.25.1