| Message ID | 20231110111823.2775-1-kdipendra88@gmail.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v2] Fixes the null pointer deferences in nsim_bpf | expand |
On Fri, 10 Nov 2023 11:18:23 +0000 Dipendra Khadka wrote: > Syzkaller found a null pointer dereference in nsim_bpf > originating from the lack of a null check for state. > > This patch fixes the issue by adding a check for state > in two functions nsim_prog_set_loaded() and nsim_setup_prog_hw_checks() > > Reported-by: syzbot+44c2416196b7c607f226@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com./bug?extid=44c2416196b7c607f226 > Fixes: 31d3ad832948 ("netdevsim: add bpf offload support") Don't think so. It's probably due to Stan's extensions / reuse of the offload infra. Please put more effort into figuring out when and why this started happening. Describe your findings in the commit message. Current patch looks too much like a bandaid. Before you repost read: https://www.kernel.org/doc/html/next/process/maintainer-netdev.html
On 11/10, Jakub Kicinski wrote: > On Fri, 10 Nov 2023 11:18:23 +0000 Dipendra Khadka wrote: > > Syzkaller found a null pointer dereference in nsim_bpf > > originating from the lack of a null check for state. > > > > This patch fixes the issue by adding a check for state > > in two functions nsim_prog_set_loaded() and nsim_setup_prog_hw_checks() > > > > Reported-by: syzbot+44c2416196b7c607f226@syzkaller.appspotmail.com > > Closes: https://syzkaller.appspot.com./bug?extid=44c2416196b7c607f226 > > Fixes: 31d3ad832948 ("netdevsim: add bpf offload support") > > Don't think so. It's probably due to Stan's extensions / reuse of > the offload infra. > > Please put more effort into figuring out when and why this started > happening. Describe your findings in the commit message. > > Current patch looks too much like a bandaid. > > Before you repost read: > https://www.kernel.org/doc/html/next/process/maintainer-netdev.html I agree, I have a similar suspicion for the same report on the bpf list [0]. 0: https://lore.kernel.org/bpf/ZU13dQb2z66CJlYi@google.com/
diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c index f60eb97e3a62..5d755da3c736 100644 --- a/drivers/net/netdevsim/bpf.c +++ b/drivers/net/netdevsim/bpf.c @@ -97,7 +97,8 @@ static void nsim_prog_set_loaded(struct bpf_prog *prog, bool loaded) return; state = prog->aux->offload->dev_priv; - state->is_loaded = loaded; + if (state) + state->is_loaded = loaded; } static int @@ -317,9 +318,11 @@ nsim_setup_prog_hw_checks(struct netdevsim *ns, struct netdev_bpf *bpf) } state = bpf->prog->aux->offload->dev_priv; - if (WARN_ON(strcmp(state->state, "xlated"))) { - NSIM_EA(bpf->extack, "offloading program in bad state"); - return -EINVAL; + if (state) { + if (WARN_ON(strcmp(state->state, "xlated"))) { + NSIM_EA(bpf->extack, "offloading program in bad state"); + return -EINVAL; + } } return 0; }
Syzkaller found a null pointer dereference in nsim_bpf originating from the lack of a null check for state. This patch fixes the issue by adding a check for state in two functions nsim_prog_set_loaded() and nsim_setup_prog_hw_checks() Reported-by: syzbot+44c2416196b7c607f226@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com./bug?extid=44c2416196b7c607f226 Fixes: 31d3ad832948 ("netdevsim: add bpf offload support") Signed-off-by: Dipendra Khadka <kdipendra88@gmail.com> --- drivers/net/netdevsim/bpf.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)