ucode-mod-bpf: fix missing resource pointer checks

uc_fn_thisval can return NULL when a method is called with a foreign or
missing this context. pin, foreach and the iterator next functions
dereferenced the result without checking it, crashing the VM.

Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/package/utils/ucode-mod-bpf/src/bpf.c b/package/utils/ucode-mod-bpf/src/bpf.c
index 33641ddfb2c4aafe2cea7a0f74df6a288c6c9cbf..0c896026dc18725594640a70345aed2150ec261a 100644 (file)
--- a/package/utils/ucode-mod-bpf/src/bpf.c
+++ b/package/utils/ucode-mod-bpf/src/bpf.c
@@ -520,6 +520,9 @@ uc_bpf_map_iter_next(uc_vm_t *vm, size_t nargs)
        struct uc_bpf_map_iter *iter = uc_fn_thisval("bpf.map_iter");
        uc_value_t *rv;
 
+       if (!iter)
+               err_return(EINVAL, NULL);
+
        if (!iter->has_next)
                return NULL;
 
@@ -536,6 +539,9 @@ uc_bpf_map_iter_next_int(uc_vm_t *vm, size_t nargs)
        uint64_t intval;
        uc_value_t *rv;
 
+       if (!iter)
+               err_return(EINVAL, NULL);
+
        if (!iter->has_next)
                return NULL;
 
@@ -561,6 +567,9 @@ uc_bpf_map_foreach(uc_vm_t *vm, size_t nargs)
        void *key, *next;
        bool ret = false;
 
+       if (!map)
+               err_return(EINVAL, NULL);
+
        key = alloca(map->key_size);
        next = alloca(map->key_size);
        has_next = !bpf_map_get_next_key(map->fd.fd, NULL, next);
@@ -597,6 +606,9 @@ uc_bpf_obj_pin(uc_vm_t *vm, size_t nargs, const char *type)
        struct uc_bpf_fd *f = uc_fn_thisval(type);
        uc_value_t *path = uc_fn_arg(0);
 
+       if (!f)
+               err_return(EINVAL, NULL);
+
        if (ucv_type(path) != UC_STRING)
                err_return(EINVAL, NULL);