Re: Null-Pointer Dereference in bpf_remove_dentry_xattr via Negative Dentry

[Matt Bobrowski <mattbobrowski@google.com>]

On Wed, Apr 29, 2026 at 04:59:01PM +0800, Quan Sun wrote:
> I found a Null-Pointer Dereference vulnerability in the Linux kernel BPF
> subsystem. The issue is triggered when a sleepable `BPF_PROG_TYPE_LSM`
> program is attached to the `bpf_lsm_inode_create` hook and invokes the BPF
> kfunc `bpf_remove_dentry_xattr` (or `bpf_set_dentry_xattr`) using a negative
> dentry. This causes the kernel to dereference a NULL inode pointer during
> lock acquisition, resulting in an immediate kernel panic.
> 
> Reported-by: Quan Sun <2022090917019@std.uestc.edu.cn>
> 
> ## Root Cause
> 
> This vulnerability is caused by a missing NULL check in the BPF filesystem
> kfuncs for extended attributes (`bpf_set_dentry_xattr` and
> `bpf_remove_dentry_xattr`).
> 
> 1. A sleepable BPF LSM program is loaded and attached to the `inode_create`
> LSM hook (`bpf_lsm_inode_create`).
> 2. When a user attempts to create a new file (e.g., via `open(...,
> O_CREAT)`), the VFS layer allocates a negative dentry (a dentry that
> represents a path but does not yet have an associated inode) and passes it
> to the `security_inode_create` hook.
> 3. The BPF LSM program is invoked and receives this negative dentry as part
> of its context (`ctx->dentry`).
> 4. The BPF program passes this dentry directly to the
> `bpf_remove_dentry_xattr` kfunc.
> 5. Inside the kfunc, the kernel calls `d_inode(dentry)` to retrieve the
> associated inode. Since the dentry is negative, this returns `NULL`.
> 6. The kfunc blindly calls `inode_lock(inode)` on the retrieved inode
> without verifying if it is valid.
> 7. Attempting to lock a NULL pointer causes a null-pointer dereference,
> leading to a kernel panic.

Sent through a fix here:
- https://lore.kernel.org/bpf/20260429205438.2601592-1-mattbobrowski@google.com/T/#u

Thanks for the report.