From: Felix Fietkau <nbd@nbd.name>
Date: Thu, 16 Jul 2026 18:04:47 +0000 (+0200)
Subject: ucode-mod-bpf: fix missing resource pointer checks
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3c5e204abe1adf5fca9a5430e0bbb5f92ca8381e;p=thirdparty%2Fopenwrt.git

ucode-mod-bpf: fix missing resource pointer checks

uc_fn_thisval can return NULL when a method is called with a foreign or
missing this context. pin, foreach and the iterator next functions
dereferenced the result without checking it, crashing the VM.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---

diff --git a/package/utils/ucode-mod-bpf/src/bpf.c b/package/utils/ucode-mod-bpf/src/bpf.c
index 33641ddfb2c..0c896026dc1 100644
--- a/package/utils/ucode-mod-bpf/src/bpf.c
+++ b/package/utils/ucode-mod-bpf/src/bpf.c
@@ -520,6 +520,9 @@ uc_bpf_map_iter_next(uc_vm_t *vm, size_t nargs)
 	struct uc_bpf_map_iter *iter = uc_fn_thisval("bpf.map_iter");
 	uc_value_t *rv;
 
+	if (!iter)
+		err_return(EINVAL, NULL);
+
 	if (!iter->has_next)
 		return NULL;
 
@@ -536,6 +539,9 @@ uc_bpf_map_iter_next_int(uc_vm_t *vm, size_t nargs)
 	uint64_t intval;
 	uc_value_t *rv;
 
+	if (!iter)
+		err_return(EINVAL, NULL);
+
 	if (!iter->has_next)
 		return NULL;
 
@@ -561,6 +567,9 @@ uc_bpf_map_foreach(uc_vm_t *vm, size_t nargs)
 	void *key, *next;
 	bool ret = false;
 
+	if (!map)
+		err_return(EINVAL, NULL);
+
 	key = alloca(map->key_size);
 	next = alloca(map->key_size);
 	has_next = !bpf_map_get_next_key(map->fd.fd, NULL, next);
@@ -597,6 +606,9 @@ uc_bpf_obj_pin(uc_vm_t *vm, size_t nargs, const char *type)
 	struct uc_bpf_fd *f = uc_fn_thisval(type);
 	uc_value_t *path = uc_fn_arg(0);
 
+	if (!f)
+		err_return(EINVAL, NULL);
+
 	if (ucv_type(path) != UC_STRING)
 		err_return(EINVAL, NULL);