linux

mirror of https://github.com/torvalds/linux.git synced 2026-07-28 10:09:10 +02:00

Linux kernel source tree

Go to file

Tengda Wu f7866c3587 bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT When loading a EXT program without specifying `attr->attach_prog_fd`, the `prog->aux->dst_prog` will be null. At this time, calling resolve_prog_type() anywhere will result in a null pointer dereference. Example stack trace: [ 8.107863] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 [ 8.108262] Mem abort info: [ 8.108384] ESR = 0x0000000096000004 [ 8.108547] EC = 0x25: DABT (current EL), IL = 32 bits [ 8.108722] SET = 0, FnV = 0 [ 8.108827] EA = 0, S1PTW = 0 [ 8.108939] FSC = 0x04: level 0 translation fault [ 8.109102] Data abort info: [ 8.109203] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 8.109399] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 8.109614] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 8.109836] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101354000 [ 8.110011] [0000000000000004] pgd=0000000000000000, p4d=0000000000000000 [ 8.112624] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 8.112783] Modules linked in: [ 8.113120] CPU: 0 PID: 99 Comm: may_access_dire Not tainted 6.10.0-rc3-next-20240613-dirty #1 [ 8.113230] Hardware name: linux,dummy-virt (DT) [ 8.113390] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 8.113429] pc : may_access_direct_pkt_data+0x24/0xa0 [ 8.113746] lr : add_subprog_and_kfunc+0x634/0x8e8 [ 8.113798] sp : ffff80008283b9f0 [ 8.113813] x29: ffff80008283b9f0 x28: ffff800082795048 x27: 0000000000000001 [ 8.113881] x26: ffff0000c0bb2600 x25: 0000000000000000 x24: 0000000000000000 [ 8.113897] x23: ffff0000c1134000 x22: 000000000001864f x21: ffff0000c1138000 [ 8.113912] x20: 0000000000000001 x19: ffff0000c12b8000 x18: ffffffffffffffff [ 8.113929] x17: 0000000000000000 x16: 0000000000000000 x15: 0720072007200720 [ 8.113944] x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 [ 8.113958] x11: 0720072007200720 x10: 0000000000f9fca4 x9 : ffff80008021f4e4 [ 8.113991] x8 : 0101010101010101 x7 : 746f72705f6d656d x6 : 000000001e0e0f5f [ 8.114006] x5 : 000000000001864f x4 : ffff0000c12b8000 x3 : 000000000000001c [ 8.114020] x2 : 0000000000000002 x1 : 0000000000000000 x0 : 0000000000000000 [ 8.114126] Call trace: [ 8.114159] may_access_direct_pkt_data+0x24/0xa0 [ 8.114202] bpf_check+0x3bc/0x28c0 [ 8.114214] bpf_prog_load+0x658/0xa58 [ 8.114227] __sys_bpf+0xc50/0x2250 [ 8.114240] __arm64_sys_bpf+0x28/0x40 [ 8.114254] invoke_syscall.constprop.0+0x54/0xf0 [ 8.114273] do_el0_svc+0x4c/0xd8 [ 8.114289] el0_svc+0x3c/0x140 [ 8.114305] el0t_64_sync_handler+0x134/0x150 [ 8.114331] el0t_64_sync+0x168/0x170 [ 8.114477] Code: 7100707f 54000081 f9401c00 f9403800 (b9400403) [ 8.118672] ---[ end trace 0000000000000000 ]--- One way to fix it is by forcing `attach_prog_fd` non-empty when bpf_prog_load(). But this will lead to `libbpf_probe_bpf_prog_type` API broken which use verifier log to probe prog type and will log nothing if we reject invalid EXT prog before bpf_check(). Another way is by adding null check in resolve_prog_type(). The issue was introduced by commit `4a9c7bbe2e` ("bpf: Resolve to prog->aux->dst_prog->type only for BPF_PROG_TYPE_EXT") which wanted to correct type resolution for BPF_PROG_TYPE_TRACING programs. Before that, the type resolution of BPF_PROG_TYPE_EXT prog actually follows the logic below: prog->aux->dst_prog ? prog->aux->dst_prog->type : prog->type; It implies that when EXT program is not yet attached to `dst_prog`, the prog type should be EXT itself. This code worked fine in the past. So just keep using it. Fix this by returning `prog->type` for BPF_PROG_TYPE_EXT if `dst_prog` is not present in resolve_prog_type(). Fixes: `4a9c7bbe2e` ("bpf: Resolve to prog->aux->dst_prog->type only for BPF_PROG_TYPE_EXT") Signed-off-by: Tengda Wu <wutengda@huaweicloud.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Cc: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20240711145819.254178-2-wutengda@huaweicloud.com		2024-07-12 22:14:15 +02:00
arch	bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG	2024-07-11 17:56:30 +02:00
block	block: unmap and free user mapped integrity via submitter	2024-06-12 11:00:50 -06:00
certs	kbuild: use $(src) instead of $(srctree)/$(src) for source directory	2024-05-10 04:34:52 +09:00
crypto	This push fixes a bug in the new ecc P521 code as well as a buggy	2024-05-20 08:47:54 -07:00
Documentation	dt-bindings: net: fsl,fman: add ptimer-handle property	2024-07-09 11:33:39 -07:00
drivers	net: ti: icssg-prueth: add missing deps	2024-07-09 11:36:17 -07:00
fs	bpf-next-for-netdev	2024-07-09 17:01:46 +02:00
include	bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT	2024-07-12 22:14:15 +02:00
init	gcc: disable '-Warray-bounds' for gcc-9	2024-06-15 10:43:04 -07:00
io_uring	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-07-04 14:16:11 -07:00
ipc	Mainly singleton patches, documented in their respective changelogs.	2024-05-19 14:02:03 -07:00
kernel	bpf: use check_sub_overflow() to check for subtraction overflows	2024-07-12 08:54:08 -07:00
lib	bpf-next-for-netdev	2024-07-09 17:01:46 +02:00
LICENSES	LICENSES: Add the copyleft-next-0.3.1 license	2022-11-08 15:44:01 +01:00
mm	mm: avoid overflows in dirty throttling logic	2024-07-03 12:29:24 -07:00
net	bpf: Remove tst_run from lwt_seg6local_prog_ops.	2024-07-10 09:58:52 -07:00
rust	rust: avoid unused import warning in `rusttest`	2024-06-11 23:33:28 +02:00
samples	bpf-next-for-netdev	2024-05-28 07:27:29 -07:00
scripts	bpf-next-for-netdev	2024-07-09 17:01:46 +02:00
security	lsm/stable-6.10 PR 20240617	2024-06-17 18:35:12 -07:00
sound	ASoC: Fixes for v6.10	2024-06-26 22:02:55 +02:00
tools	selftests/bpf: DENYLIST.aarch64: Skip fexit_sleep again	2024-07-12 18:17:50 +02:00
usr	kbuild: use $(src) instead of $(srctree)/$(src) for source directory	2024-05-10 04:34:52 +09:00
virt	KVM fixes for 6.10	2024-06-21 08:03:55 -04:00
.clang-format	clang-format: Update with v6.7-rc4's `for_each` macro list	2023-12-08 23:54:38 +01:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.editorconfig	.editorconfig: remove trim_trailing_whitespace option	2024-06-13 16:47:52 +02:00
.get_maintainer.ignore	Add Jeff Kirsher to .get_maintainer.ignore	2024-03-08 11:36:54 +00:00
.gitattributes	.gitattributes: set diff driver for Rust source code files	2023-05-31 17:48:25 +02:00
.gitignore	kbuild: create a list of all built DTB files	2024-02-19 18:20:39 +09:00
.mailmap	bpf-for-netdev	2024-06-14 17:57:10 -07:00
.rustfmt.toml	rust: add `.rustfmt.toml`	2022-09-28 09:02:20 +02:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Remembering Larry Finger	2024-06-26 20:34:51 +03:00
Kbuild	Kbuild updates for v6.1	2022-10-10 12:00:45 -07:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-07-04 14:16:11 -07:00
Makefile	Linux 6.10-rc6	2024-06-30 14:40:44 -07:00
README	README: Fix spelling	2024-03-18 03:36:32 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.