From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jesper Dangaard Brouer Subject: Re: [PATCH bpf v2] bpf: fix null pointer deref in bpf_prog_test_run_xdp Date: Wed, 31 Jan 2018 15:52:12 +0100 Message-ID: <20180131155212.173a1360@redhat.com> References: <20180131115856.2965-1-daniel@iogearbox.net> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: brouer@redhat.com, alexei.starovoitov@gmail.com, netdev@vger.kernel.org To: Daniel Borkmann Return-path: Received: from mx1.redhat.com ([209.132.183.28]:36420 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752965AbeAaOwS (ORCPT ); Wed, 31 Jan 2018 09:52:18 -0500 In-Reply-To: <20180131115856.2965-1-daniel@iogearbox.net> Sender: netdev-owner@vger.kernel.org List-ID: On Wed, 31 Jan 2018 12:58:56 +0100 Daniel Borkmann wrote: > syzkaller was able to generate the following XDP program ... > > (18) r0 = 0x0 > (61) r5 = *(u32 *)(r1 +12) > (04) (u32) r0 += (u32) 0 > (95) exit > > ... and trigger a NULL pointer dereference in ___bpf_prog_run() > via bpf_prog_test_run_xdp() where this was attempted to run. > > Reason is that recent xdp_rxq_info addition to XDP programs > updated all drivers, but not bpf_prog_test_run_xdp(), where > xdp_buff is set up. Thus when context rewriter does the deref > on the netdev it's NULL at runtime. Fix it by using xdp_rxq > from loopback dev. __netif_get_rx_queue() helper can also be > reused in various other locations later on. > > Fixes: 02dd3291b2f0 ("bpf: finally expose xdp_rxq_info to XDP bpf-programs") > Reported-by: syzbot+1eb094057b338eb1fc00@syzkaller.appspotmail.com > Signed-off-by: Daniel Borkmann > Cc: Jesper Dangaard Brouer Acked-by: Jesper Dangaard Brouer -- Best regards, Jesper Dangaard Brouer MSc.CS, Principal Kernel Engineer at Red Hat LinkedIn: http://www.linkedin.com/in/brouer