bpftool: Fix UAF in get_delegate_value
authorTao Chen <chen.dylane@linux.dev>
Fri, 19 Sep 2025 03:48:16 +0000 (11:48 +0800)
committerAndrii Nakryiko <andrii@kernel.org>
Fri, 19 Sep 2025 22:37:30 +0000 (15:37 -0700)
commit57cb26950112f0dfa9077b2710b1c280efa97e81
treec7a7b2b86f42ae0229800ebc21c6535f238f9b7e
parentbce5749b02019f9b7e60fdff584098e57337c8b6
bpftool: Fix UAF in get_delegate_value

The return value ret pointer is pointing opts_copy, but opts_copy
gets freed in get_delegate_value before return, fix this by free
the mntent->mnt_opts strdup memory after show delegate value.

Fixes: 2d812311c2b2 ("bpftool: Add bpf_token show")
Signed-off-by: Tao Chen <chen.dylane@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Quentin Monnet <qmo@kernel.org>
Link: https://lore.kernel.org/bpf/20250919034816.1287280-2-chen.dylane@linux.dev
tools/bpf/bpftool/token.c