| Message ID | 20201112001919.2028357-1-kafai@fb.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 09a3dac7b579e57e7ef2d875b9216c845ae8a0e5 |
| Delegated to: | BPF |
| Headers | show |
| Series | [bpf-next] bpf: Fix NULL dereference in bpf_task_storage | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for bpf-next |
| netdev/subject_prefix | success | Link |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | fail | Errors and warnings before: 5 this patch: 5 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | fail | Link |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 1 this patch: 1 |
| netdev/header_inline | success | Link |
| netdev/stable | success | Stable not CCed |
Hello: This patch was applied to bpf/bpf-next.git (refs/heads/master): On Wed, 11 Nov 2020 16:19:19 -0800 you wrote: > In bpf_pid_task_storage_update_elem(), it missed to > test the !task_storage_ptr(task) which then could trigger a NULL > pointer exception in bpf_local_storage_update(). > > Fixes: 4cf1bc1f1045 ("bpf: Implement task local storage") > Tested-by: Roman Gushchin <guro@fb.com> > Cc: KP Singh <kpsingh@chromium.org> > Signed-off-by: Martin KaFai Lau <kafai@fb.com> > > [...] Here is the summary with links: - [bpf-next] bpf: Fix NULL dereference in bpf_task_storage https://git.kernel.org/bpf/bpf-next/c/09a3dac7b579 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/kernel/bpf/bpf_task_storage.c b/kernel/bpf/bpf_task_storage.c index 39a45fba4fb0..4ef1959a78f2 100644 --- a/kernel/bpf/bpf_task_storage.c +++ b/kernel/bpf/bpf_task_storage.c @@ -150,7 +150,7 @@ static int bpf_pid_task_storage_update_elem(struct bpf_map *map, void *key, */ WARN_ON_ONCE(!rcu_read_lock_held()); task = pid_task(pid, PIDTYPE_PID); - if (!task) { + if (!task || !task_storage_ptr(task)) { err = -ENOENT; goto out; }
In bpf_pid_task_storage_update_elem(), it missed to test the !task_storage_ptr(task) which then could trigger a NULL pointer exception in bpf_local_storage_update(). Fixes: 4cf1bc1f1045 ("bpf: Implement task local storage") Tested-by: Roman Gushchin <guro@fb.com> Cc: KP Singh <kpsingh@chromium.org> Signed-off-by: Martin KaFai Lau <kafai@fb.com> --- kernel/bpf/bpf_task_storage.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)