Re: [PATCH v2] bpf: fix NULL pointer dereference in print_reg_state()

[KaFai Wan <kafai.wan@linux.dev>]

[-- Attachment #1: Type: text/plain, Size: 2101 bytes --]

On Tue, 2025-09-30 at 23:51 +0530, Brahmajit Das wrote:
> On 26.09.2025 18:36, KaFai Wan wrote:
> > On Fri, 2025-09-26 at 06:34 +0530, Brahmajit Das wrote:
> > > On 25.09.2025 23:31, KaFai Wan wrote:
> > > > On Wed, 2025-09-24 at 23:58 +0530, Brahmajit Das wrote:
> > > > > On 25.09.2025 01:38, KaFai Wan wrote:
> > > > > > On Wed, 2025-09-24 at 21:10 +0530, Brahmajit Das wrote:
> > > > > > > On 24.09.2025 09:32, Alexei Starovoitov wrote:
> > > > > > > > On Wed, Sep 24, 2025 at 1:43 AM Brahmajit Das
> > > > > > > > <listout@listout.xyz>
> > > > > > > > wrote:
> > > > > > > > > 
> > > > > > > > > Syzkaller reported a general protection fault due to a
> > > > > > > > > NULL
> > > > > > > > > pointer
> > > > > > > > > dereference in print_reg_state() when accessing reg-
> > > > > > > > > > map_ptr
> > > > > > > > > without
> > > > > > > > > checking if it is NULL.
> > > > > > > > > 
> ...snip...
> > 
> > You should add a Fixes label in the commit log and add selftest for it
> > in V3. 
> > Fixes label is Fixes: aced132599b3 ("bpf: Add range tracking for
> > BPF_NEG")
> > For selftest you may check the test in verifier_value_illegal_alu.c and
> > other files.  
> > 
> > The code in your next post would change the behavior of BPF_NEG and 
> > BPF_END, you can run the selftest to check that.
> > 
> 
> KaFai, I'm quite new to kernel development. I'm been trying to write a
> selftest for this unfortunately been having a hard time. I would really
> appreciate some help. For now I tried to create on from the initial test
> you used to verify this bug i.e. r0 -= r0.
> 
> I have tried testing my changes via sending a pull request on the
> kernel-patches/bpf repository, but seems like it's failing.
> My pull request: https://github.com/kernel-patches/bpf/pull/9900
> 

The attachment is the patch for selftest, you can apply it.

The patch#1 in your PR, Add the Oops call trace or the Closes label in commit
log could be better. 

Closes: https://lore.kernel.org/all/68d26227.a70a0220.1b52b.02a4.GAE@google.com/
-- 
Thanks,
KaFai

[-- Attachment #2: 0001-selftests-bpf-Add-test-for-BPF_NEG-alu-on-CONST_PTR_.patch --]
[-- Type: text/x-patch, Size: 1652 bytes --]

From 2cb7fe5d4c707d8f5663829bacf2606648be185a Mon Sep 17 00:00:00 2001
From: KaFai Wan <kafai.wan@linux.dev>
Date: Wed, 1 Oct 2025 11:56:51 +0800
Subject: [PATCH] selftests/bpf: Add test for BPF_NEG alu on CONST_PTR_TO_MAP

From: KaFai Wan <kafai.wan@linux.dev>

Add a test case for BPF_NEG operation on CONST_PTR_TO_MAP. Tests if
BPF_NEG operation on map_ptr is rejected in unprivileged mode and is a
scalar value and do not trigger Oops in privileged mode.

Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
---
 .../bpf/progs/verifier_value_illegal_alu.c     | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c b/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c
index a99b86c506f7..a850dde95d0e 100644
--- a/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c
+++ b/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c
@@ -182,6 +182,24 @@ __naked void map_ptr_illegal_alu_op(void)
 	: __clobber_all);
 }
 
+SEC("socket")
+__description("map_ptr illegal alu op, map_ptr = -map_ptr")
+__failure __msg("R0 invalid mem access 'scalar'")
+__failure_unpriv __msg_unpriv("R0 pointer arithmetic prohibited")
+__flag(BPF_F_ANY_ALIGNMENT)
+__naked void map_ptr_illegal_alu_op(void)
+{
+	asm volatile ("					\
+	r0 = %[map_hash_48b] ll;			\
+	r0 = -r0;					\
+	r1 = 22;					\
+	*(u64*)(r0 + 0) = r1;				\
+	exit;						\
+"	:
+	: __imm_addr(map_hash_48b)
+	: __clobber_all);
+}
+
 SEC("flow_dissector")
 __description("flow_keys illegal alu op with variable offset")
 __failure __msg("R7 pointer arithmetic on flow_keys prohibited")
-- 
2.43.0