diff mbox series

[net] bpf: Add missing map_get_next_key method to bloom filter map

Message ID 20220104090130.3121751-1-eric.dumazet@gmail.com (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series [net] bpf: Add missing map_get_next_key method to bloom filter map | expand

Checks

Context Check Description
netdev/tree_selection success Clearly marked for net
netdev/fixes_present success Fixes tag present in non-next series
netdev/subject_prefix success Link
netdev/cover_letter success Single patches do not need cover letters
netdev/patch_count success Link
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 2 this patch: 2
netdev/cc_maintainers fail 2 blamed authors not CCed: andrii@kernel.org joannekoong@fb.com; 6 maintainers not CCed: andrii@kernel.org kpsingh@kernel.org joannekoong@fb.com john.fastabend@gmail.com kafai@fb.com songliubraving@fb.com
netdev/build_clang success Errors and warnings before: 20 this patch: 20
netdev/module_param success Was 0 now: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/verify_fixes success Fixes tag looks correct
netdev/build_allmodconfig_warn success Errors and warnings before: 4 this patch: 4
netdev/checkpatch warning WARNING: ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-next pending VM_Test
bpf/vmtest-bpf-next-PR pending PR summary

Commit Message

Eric Dumazet Jan. 4, 2022, 9:01 a.m. UTC 
From: Eric Dumazet <edumazet@google.com>

It appears map_get_next_key() method is mandatory,
as syzbot is able to trigger a NULL deref in map_get_next_key().

Fixes: 9330986c0300 ("bpf: Add bloom filter map implementation")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Yonghong Song <yhs@fb.com>
---
 kernel/bpf/bloom_filter.c | 7 +++++++
 1 file changed, 7 insertions(+)

Comments

Daniel Borkmann Jan. 4, 2022, 9:21 a.m. UTC | #1 
Hi Eric, [ +Joanne, ]

On 1/4/22 10:01 AM, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
> 
> It appears map_get_next_key() method is mandatory,
> as syzbot is able to trigger a NULL deref in map_get_next_key().
> 
> Fixes: 9330986c0300 ("bpf: Add bloom filter map implementation")
> Reported-by: syzbot <syzkaller@googlegroups.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Alexei Starovoitov <ast@kernel.org>
> Cc: Yonghong Song <yhs@fb.com>

Thanks for your patch, this has recently been fixed:

   https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=3ccdcee28415c4226de05438b4d89eb5514edf73

I'm not quite sure why it was applied to bpf-next instead of bpf (maybe assumption was
that there would be no rc8 anymore), but I'd expect it to land in Linus' tree once merge
window opens up on 9th Jan. In that case stable team would have to pick it up for 5.16.

Thanks,
Daniel
Eric Dumazet Jan. 4, 2022, 9:33 a.m. UTC | #2 
On Tue, Jan 4, 2022 at 1:21 AM Daniel Borkmann <daniel@iogearbox.net> wrote:
>
> Hi Eric, [ +Joanne, ]
>
> On 1/4/22 10:01 AM, Eric Dumazet wrote:
> > From: Eric Dumazet <edumazet@google.com>
> >
> > It appears map_get_next_key() method is mandatory,
> > as syzbot is able to trigger a NULL deref in map_get_next_key().
> >
> > Fixes: 9330986c0300 ("bpf: Add bloom filter map implementation")
> > Reported-by: syzbot <syzkaller@googlegroups.com>
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > Cc: Alexei Starovoitov <ast@kernel.org>
> > Cc: Yonghong Song <yhs@fb.com>
>
> Thanks for your patch, this has recently been fixed:
>
>    https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=3ccdcee28415c4226de05438b4d89eb5514edf73
>
> I'm not quite sure why it was applied to bpf-next instead of bpf (maybe assumption was
> that there would be no rc8 anymore), but I'd expect it to land in Linus' tree once merge
> window opens up on 9th Jan. In that case stable team would have to pick it up for 5.16.
>

Ah, this is why I could not find the fix in bpf or net tree, thanks.


> Thanks,
> Daniel
diff mbox series

Patch

diff --git a/kernel/bpf/bloom_filter.c b/kernel/bpf/bloom_filter.c
index 277a05e9c9849324a277d77eeec12963cc7519b7..34f48058515cfd3f8ea6816ccad1f4a26eba0ebf 100644
--- a/kernel/bpf/bloom_filter.c
+++ b/kernel/bpf/bloom_filter.c
@@ -82,6 +82,12 @@  static int bloom_map_delete_elem(struct bpf_map *map, void *value)
 	return -EOPNOTSUPP;
 }
 
+static int bloom_get_next_key(struct bpf_map *map, void *key,
+			      void *next_key)
+{
+	return -ENOTSUPP;
+}
+
 static struct bpf_map *bloom_map_alloc(union bpf_attr *attr)
 {
 	u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits;
@@ -201,4 +207,5 @@  const struct bpf_map_ops bloom_filter_map_ops = {
 	.map_check_btf = bloom_map_check_btf,
 	.map_btf_name = "bpf_bloom_filter",
 	.map_btf_id = &bpf_bloom_map_btf_id,
+	.map_get_next_key = bloom_get_next_key,
 };