From: Kohei Enju <enjuk@amazon.com>
To: <syzbot+a5964227adc0f904549c@syzkaller.appspotmail.com>
Cc: <andrii@kernel.org>, <ast@kernel.org>, <bpf@vger.kernel.org>,
<daniel@iogearbox.net>, <eddyz87@gmail.com>, <haoluo@google.com>,
<iii@linux.ibm.com>, <john.fastabend@gmail.com>,
<jolsa@kernel.org>, <kpsingh@kernel.org>,
<linux-kernel@vger.kernel.org>, <martin.lau@linux.dev>,
<netdev@vger.kernel.org>, <sdf@fomichev.me>, <song@kernel.org>,
<syzkaller-bugs@googlegroups.com>, <yepeilin@google.com>,
<yonghong.song@linux.dev>
Subject: Re: [syzbot] [bpf?] KASAN: slab-out-of-bounds Read in atomic_ptr_type_ok
Date: Sat, 15 Mar 2025 03:19:25 +0900 [thread overview]
Message-ID: <20250314181925.69459-1-enjuk@amazon.com> (raw)
In-Reply-To: <67d30ef2.050a0220.14e108.0039.GAE@google.com>
> syzbot found the following issue on:
>
> HEAD commit: f28214603dc6 Merge branch 'selftests-bpf-move-test_lwt_seg..
> git tree: bpf-next
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=15f84664580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=b7bde34acd8f53b1
> dashboard link: https://syzkaller.appspot.com/bug?extid=a5964227adc0f904549c
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16450ba8580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11f5fa54580000
#syz test
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7788,6 +7788,12 @@ static int check_atomic_rmw(struct bpf_verifier_env *env,
static int check_atomic_load(struct bpf_verifier_env *env,
struct bpf_insn *insn)
{
+ int err;
+
+ err = check_reg_arg(env, insn->src_reg, SRC_OP);
+ if (err)
+ return err;
+
if (!atomic_ptr_type_ok(env, insn->src_reg, insn)) {
verbose(env, "BPF_ATOMIC loads from R%d %s is not allowed\n",
insn->src_reg,
@@ -7801,6 +7807,12 @@ static int check_atomic_load(struct bpf_verifier_env *env,
static int check_atomic_store(struct bpf_verifier_env *env,
struct bpf_insn *insn)
{
+ int err;
+
+ err = check_reg_arg(env, insn->dst_reg, SRC_OP);
+ if (err)
+ return err;
+
if (!atomic_ptr_type_ok(env, insn->dst_reg, insn)) {
verbose(env, "BPF_ATOMIC stores into R%d %s is not allowed\n",
insn->dst_reg,
next prev parent reply other threads:[~2025-03-14 18:19 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-13 16:59 [syzbot] [bpf?] KASAN: slab-out-of-bounds Read in atomic_ptr_type_ok syzbot
2025-03-14 18:19 ` Kohei Enju [this message]
2025-03-14 18:47 ` syzbot
2025-03-15 5:10 ` Kohei Enju
2025-03-15 5:38 ` syzbot
2025-03-15 5:59 ` Kohei Enju
2025-03-15 6:27 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250314181925.69459-1-enjuk@amazon.com \
--to=enjuk@amazon.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=iii@linux.ibm.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=netdev@vger.kernel.org \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=syzbot+a5964227adc0f904549c@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yepeilin@google.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.