| Message ID | 20240711145819.254178-1-wutengda@huaweicloud.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | bpf: Fix null-pointer-deref in resolve_prog_type() | expand |
Hello: This series was applied to bpf/bpf-next.git (master) by Daniel Borkmann <daniel@iogearbox.net>: On Thu, 11 Jul 2024 22:58:17 +0800 you wrote: > Hi, > > This patchset is going to fix null-pointer-deref in resolve_prog_type() > for BPF_PROG_TYPE_EXT. > > `prog->aux->dst_prog` in resolve_prog_type() is assigned by > `attach_prog_fd`, and would be NULL if `attach_prog_fd` is not > provided. Loading EXT prog with bpf_dynptr_from_skb() kfunc call > in this way will lead to null-pointer-deref. > > [...] Here is the summary with links: - [bpf,v4,1/2] bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT https://git.kernel.org/bpf/bpf-next/c/f7866c358733 - [bpf,v4,2/2] selftests/bpf: Test for null-pointer-deref bugfix in resolve_prog_type() https://git.kernel.org/bpf/bpf-next/c/e435b043d89a You are awesome, thank you!
Hi, This patchset is going to fix null-pointer-deref in resolve_prog_type() for BPF_PROG_TYPE_EXT. `prog->aux->dst_prog` in resolve_prog_type() is assigned by `attach_prog_fd`, and would be NULL if `attach_prog_fd` is not provided. Loading EXT prog with bpf_dynptr_from_skb() kfunc call in this way will lead to null-pointer-deref. In last version we fix it by forcing `attach_prog_fd` non-empty at load time, which leads to libbpf_probe_prog_types() api broken. Currently, we fix it by just adding null check for EXT prog in resolve_prog_type() as the old way did. For the sake of safety, we compared the full test logs of selftest before and after applying these changes, and the results show that the two test logs were consistent. Best regards, Tengda Change list: v4: - Fix by add null check in resolve_prog_type() which can avoid libbpf_probe_prog_types api breaking. v3: - Add a small selftest for the BPF CI, and split 1-patch into 3-patch series as recommended by Daniel. https://lore.kernel.org/all/d16b4f29-8966-464f-b530-35e39fda3f46@huaweicloud.com/ v2: - Fix libbpf_probe_prog_types test failure reported by CI by adapting libbpf code. (thanks for jirka's reminder) v1: https://lore.kernel.org/all/20240620060701.1465291-1-wutengda@huaweicloud.com/ Tengda Wu (2): bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT selftests/bpf: Test for null-pointer-deref bugfix in resolve_prog_type() include/linux/bpf_verifier.h | 2 +- tools/testing/selftests/bpf/verifier/calls.c | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-)