diff mbox series

[bpf-next,1/3] bpf: Fix an issue due to uninitialized bpf_iter_task

Message ID 20240208090906.56337-2-laoar.shao@gmail.com (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series bpf: Fix an issue in bpf_iter_task | expand

Checks

Context Check Description
bpf/vmtest-bpf-next-PR success PR summary
netdev/series_format success Posting correctly formatted
netdev/tree_selection success Clearly marked for bpf-next
netdev/ynl success Generated files up to date; no warnings/errors; no diff in generated;
netdev/fixes_present success Fixes tag not required for -next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 1059 this patch: 1059
netdev/build_tools success No tools touched, skip
netdev/cc_maintainers success CCed 14 of 14 maintainers
netdev/build_clang success Errors and warnings before: 1066 this patch: 1066
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success Fixes tag looks correct
netdev/build_allmodconfig_warn success Errors and warnings before: 1076 this patch: 1076
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 8 lines checked
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-next-VM_Test-21 success Logs for x86_64-gcc / test (test_maps, false, 360) / test_maps on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-24 success Logs for x86_64-gcc / test (test_progs_no_alu32_parallel, true, 30) / test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-23 success Logs for x86_64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-25 success Logs for x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-26 success Logs for x86_64-gcc / test (test_verifier, false, 360) / test_verifier on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-27 success Logs for x86_64-gcc / veristat / veristat on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-31 success Logs for x86_64-llvm-17 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-30 success Logs for x86_64-llvm-17 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-32 success Logs for x86_64-llvm-17 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-37 success Logs for x86_64-llvm-18 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-41 success Logs for x86_64-llvm-18 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-38 success Logs for x86_64-llvm-18 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-39 success Logs for x86_64-llvm-18 / test (test_progs_cpuv4, false, 360) / test_progs_cpuv4 on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-40 success Logs for x86_64-llvm-18 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-14 success Logs for s390x-gcc / test (test_progs, false, 360) / test_progs on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-0 success Logs for Lint
bpf/vmtest-bpf-next-VM_Test-1 success Logs for ShellCheck
bpf/vmtest-bpf-next-VM_Test-2 success Logs for Unittests
bpf/vmtest-bpf-next-VM_Test-3 success Logs for Validate matrix.py
bpf/vmtest-bpf-next-VM_Test-5 success Logs for aarch64-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-4 success Logs for aarch64-gcc / build / build for aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-10 success Logs for aarch64-gcc / veristat
bpf/vmtest-bpf-next-VM_Test-12 success Logs for s390x-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-13 success Logs for set-matrix
bpf/vmtest-bpf-next-VM_Test-15 success Logs for x86_64-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-8 success Logs for aarch64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-6 success Logs for aarch64-gcc / test (test_maps, false, 360) / test_maps on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-7 success Logs for aarch64-gcc / test (test_progs, false, 360) / test_progs on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-9 success Logs for aarch64-gcc / test (test_verifier, false, 360) / test_verifier on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-16 success Logs for x86_64-llvm-17 / build / build for x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-22 success Logs for x86_64-llvm-17 / veristat
bpf/vmtest-bpf-next-VM_Test-11 success Logs for s390x-gcc / build / build for s390x with gcc
bpf/vmtest-bpf-next-VM_Test-17 success Logs for s390x-gcc / veristat
bpf/vmtest-bpf-next-VM_Test-19 success Logs for x86_64-gcc / build / build for x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-18 success Logs for set-matrix
bpf/vmtest-bpf-next-VM_Test-20 success Logs for x86_64-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-28 success Logs for x86_64-llvm-17 / build / build for x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-34 success Logs for x86_64-llvm-17 / veristat
bpf/vmtest-bpf-next-VM_Test-35 success Logs for x86_64-llvm-18 / build / build for x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-42 success Logs for x86_64-llvm-18 / veristat
bpf/vmtest-bpf-next-VM_Test-36 success Logs for x86_64-llvm-18 / build-release / build for x86_64 with llvm-18 and -O2 optimization
bpf/vmtest-bpf-next-VM_Test-29 success Logs for x86_64-llvm-17 / build-release / build for x86_64 with llvm-17 and -O2 optimization
bpf/vmtest-bpf-next-VM_Test-33 success Logs for x86_64-llvm-17 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-17

Commit Message

Yafang Shao Feb. 8, 2024, 9:09 a.m. UTC 
Failure to initialize it->pos, coupled with the presence of an invalid
value in the flags variable, can lead to it->pos referencing an invalid
task, potentially resulting in a kernel panic. To mitigate this risk, it's
crucial to ensure proper initialization of it->pos to 0. 

Fixes: c68a78ffe2cb ("bpf: Introduce task open coded iterator kfuncs")
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Cc: Chuyi Zhou <zhouchuyi@bytedance.com>
---
 kernel/bpf/task_iter.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Chuyi Zhou Feb. 8, 2024, 9:41 a.m. UTC | #1 
Hello,

在 2024/2/8 17:09, Yafang Shao 写道:
> Failure to initialize it->pos, coupled with the presence of an invalid
> value in the flags variable, can lead to it->pos referencing an invalid
> task, potentially resulting in a kernel panic. To mitigate this risk, it's
> crucial to ensure proper initialization of it->pos to 0.
> 
> Fixes: c68a78ffe2cb ("bpf: Introduce task open coded iterator kfuncs")
> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> Cc: Chuyi Zhou <zhouchuyi@bytedance.com>
> ---
>   kernel/bpf/task_iter.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c
> index e5c3500443c6..ec4e97c61eef 100644
> --- a/kernel/bpf/task_iter.c
> +++ b/kernel/bpf/task_iter.c
> @@ -978,6 +978,8 @@ __bpf_kfunc int bpf_iter_task_new(struct bpf_iter_task *it,
>   	BUILD_BUG_ON(__alignof__(struct bpf_iter_task_kern) !=
>   					__alignof__(struct bpf_iter_task));
>   
> +	kit->pos = NULL;
> +
>   	switch (flags) {
>   	case BPF_TASK_ITER_ALL_THREADS:
>   	case BPF_TASK_ITER_ALL_PROCS:

LGTM.

Actually commit c68a78ffe2c ("bpf: Introduce task open coded iterator 
kfuncs") initialize it->pos to NULL. But it seems the following commit
ac8148d957f5043 ("bpf: bpf_iter_task_next: use next_task(kit->task) 
rather than next_task(kit->pos)") drops this initialization.

Thanks.
Yafang Shao Feb. 8, 2024, 9:48 a.m. UTC | #2 
On Thu, Feb 8, 2024 at 5:41 PM Chuyi Zhou <zhouchuyi@bytedance.com> wrote:
>
> Hello,
>
> 在 2024/2/8 17:09, Yafang Shao 写道:
> > Failure to initialize it->pos, coupled with the presence of an invalid
> > value in the flags variable, can lead to it->pos referencing an invalid
> > task, potentially resulting in a kernel panic. To mitigate this risk, it's
> > crucial to ensure proper initialization of it->pos to 0.
> >
> > Fixes: c68a78ffe2cb ("bpf: Introduce task open coded iterator kfuncs")
> > Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> > Cc: Chuyi Zhou <zhouchuyi@bytedance.com>
> > ---
> >   kernel/bpf/task_iter.c | 2 ++
> >   1 file changed, 2 insertions(+)
> >
> > diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c
> > index e5c3500443c6..ec4e97c61eef 100644
> > --- a/kernel/bpf/task_iter.c
> > +++ b/kernel/bpf/task_iter.c
> > @@ -978,6 +978,8 @@ __bpf_kfunc int bpf_iter_task_new(struct bpf_iter_task *it,
> >       BUILD_BUG_ON(__alignof__(struct bpf_iter_task_kern) !=
> >                                       __alignof__(struct bpf_iter_task));
> >
> > +     kit->pos = NULL;
> > +
> >       switch (flags) {
> >       case BPF_TASK_ITER_ALL_THREADS:
> >       case BPF_TASK_ITER_ALL_PROCS:
>
> LGTM.
>
> Actually commit c68a78ffe2c ("bpf: Introduce task open coded iterator
> kfuncs") initialize it->pos to NULL. But it seems the following commit
> ac8148d957f5043 ("bpf: bpf_iter_task_next: use next_task(kit->task)
> rather than next_task(kit->pos)") drops this initialization.
>

Thanks for your quick response. Will update the fixes tag in the next version.
Yonghong Song Feb. 8, 2024, 3:52 p.m. UTC | #3 
On 2/8/24 1:41 AM, Chuyi Zhou wrote:
> Hello,
>
> 在 2024/2/8 17:09, Yafang Shao 写道:
>> Failure to initialize it->pos, coupled with the presence of an invalid
>> value in the flags variable, can lead to it->pos referencing an invalid
>> task, potentially resulting in a kernel panic. To mitigate this risk, 
>> it's
>> crucial to ensure proper initialization of it->pos to 0.
>>
>> Fixes: c68a78ffe2cb ("bpf: Introduce task open coded iterator kfuncs")
>> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
>> Cc: Chuyi Zhou <zhouchuyi@bytedance.com>
>> ---
>>   kernel/bpf/task_iter.c | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c
>> index e5c3500443c6..ec4e97c61eef 100644
>> --- a/kernel/bpf/task_iter.c
>> +++ b/kernel/bpf/task_iter.c
>> @@ -978,6 +978,8 @@ __bpf_kfunc int bpf_iter_task_new(struct 
>> bpf_iter_task *it,
>>       BUILD_BUG_ON(__alignof__(struct bpf_iter_task_kern) !=
>>                       __alignof__(struct bpf_iter_task));
>>   +    kit->pos = NULL;
>> +
>>       switch (flags) {
>>       case BPF_TASK_ITER_ALL_THREADS:
>>       case BPF_TASK_ITER_ALL_PROCS:
>
> LGTM.
>
> Actually commit c68a78ffe2c ("bpf: Introduce task open coded iterator 
> kfuncs") initialize it->pos to NULL. But it seems the following commit
> ac8148d957f5043 ("bpf: bpf_iter_task_next: use next_task(kit->task) 
> rather than next_task(kit->pos)") drops this initialization.

Sorry, I missed this during reviewing commit ac8148d957f5043.
Your change LGTM.

Acked-by: Yonghong Song <yonghong.song@linux.dev>
Alexei Starovoitov Feb. 8, 2024, 5:21 p.m. UTC | #4 
On Thu, Feb 8, 2024 at 7:53 AM Yonghong Song <yonghong.song@linux.dev> wrote:
>
>
> On 2/8/24 1:41 AM, Chuyi Zhou wrote:
> > Hello,
> >
> > 在 2024/2/8 17:09, Yafang Shao 写道:
> >> Failure to initialize it->pos, coupled with the presence of an invalid
> >> value in the flags variable, can lead to it->pos referencing an invalid
> >> task, potentially resulting in a kernel panic. To mitigate this risk,
> >> it's
> >> crucial to ensure proper initialization of it->pos to 0.
> >>
> >> Fixes: c68a78ffe2cb ("bpf: Introduce task open coded iterator kfuncs")
> >> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> >> Cc: Chuyi Zhou <zhouchuyi@bytedance.com>
> >> ---
> >>   kernel/bpf/task_iter.c | 2 ++
> >>   1 file changed, 2 insertions(+)
> >>
> >> diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c
> >> index e5c3500443c6..ec4e97c61eef 100644
> >> --- a/kernel/bpf/task_iter.c
> >> +++ b/kernel/bpf/task_iter.c
> >> @@ -978,6 +978,8 @@ __bpf_kfunc int bpf_iter_task_new(struct
> >> bpf_iter_task *it,
> >>       BUILD_BUG_ON(__alignof__(struct bpf_iter_task_kern) !=
> >>                       __alignof__(struct bpf_iter_task));
> >>   +    kit->pos = NULL;
> >> +
> >>       switch (flags) {
> >>       case BPF_TASK_ITER_ALL_THREADS:
> >>       case BPF_TASK_ITER_ALL_PROCS:
> >
> > LGTM.
> >
> > Actually commit c68a78ffe2c ("bpf: Introduce task open coded iterator
> > kfuncs") initialize it->pos to NULL. But it seems the following commit
> > ac8148d957f5043 ("bpf: bpf_iter_task_next: use next_task(kit->task)
> > rather than next_task(kit->pos)") drops this initialization.
>
> Sorry, I missed this during reviewing commit ac8148d957f5043.
> Your change LGTM.

Ohh. Pls cc Oleg when you respin.

> Acked-by: Yonghong Song <yonghong.song@linux.dev>
>
>
diff mbox series

Patch

diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c
index e5c3500443c6..ec4e97c61eef 100644
--- a/kernel/bpf/task_iter.c
+++ b/kernel/bpf/task_iter.c
@@ -978,6 +978,8 @@  __bpf_kfunc int bpf_iter_task_new(struct bpf_iter_task *it,
 	BUILD_BUG_ON(__alignof__(struct bpf_iter_task_kern) !=
 					__alignof__(struct bpf_iter_task));
 
+	kit->pos = NULL;
+
 	switch (flags) {
 	case BPF_TASK_ITER_ALL_THREADS:
 	case BPF_TASK_ITER_ALL_PROCS: