Re: [PATCH bpf v2] bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [High] The NULL pointer dereference fix in the diag paths is incomplete due to a Time-Of-Check to Time-Of-Use (TOCTOU) race condition in `diag_get()`.
--

commit 89ba4092c0928afed16ec4db32d2b5ffaa88889b
Author: Weiming Shi <bestswngs@gmail.com>

bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths

This commit adds NULL checks for the storage map pointer in
bpf_sk_storage_clone() and bpf_sk_storage_diag_put_all() to prevent a
NULL pointer dereference when racing with a concurrent storage map removal.

> diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c
> index 14eb7812bda4a..b2cd2b0292cb6 100644
> --- a/net/core/bpf_sk_storage.c
> +++ b/net/core/bpf_sk_storage.c

[ ... ]

> @@ -596,6 +596,8 @@ static int bpf_sk_storage_diag_put_all(struct sock *sk, struct sk_buff *skb,
>  	saved_len = skb->len;
>  	hlist_for_each_entry_rcu(selem, &sk_storage->list, snode) {
>  		smap = rcu_dereference(SDATA(selem)->smap);
> +		if (!smap)
> +			continue;
>  		diag_size += nla_value_size(smap->map.value_size);
>  
>  		if (nla_stgs && diag_get(SDATA(selem), skb))

Can this still trigger a NULL pointer dereference due to a race condition?

If a concurrent unlinking operation sets the storage map pointer to NULL
after the check above, but before diag_get() executes, it looks like
diag_get() could still read the NULL pointer:

net/core/bpf_sk_storage.c:diag_get() {
    ...
    smap = rcu_dereference(sdata->smap);
    if (nla_put_u32(skb, SK_DIAG_BPF_STORAGE_MAP_ID, smap->map.id))
    ...
}

Because rcu_dereference() re-fetches the pointer from memory, it could now
return NULL, leading to a crash on the smap->map.id access.

Would it be safer to pass the already-validated smap pointer directly to
diag_get() as an argument, or add a NULL check inside diag_get() itself?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260421155024.997077-2-bestswngs@gmail.com?part=1