diff options
| author | Eduard Zingerman <eddyz87@gmail.com> | 2024-12-11 23:07:10 -0800 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2024-12-12 11:37:19 -0800 |
| commit | ac6542ad92759cda383ad62b4e4cbfc28136abc1 (patch) | |
| tree | 8466ba59d213014cd67f6e9403a4713bdf0f4769 /tools/testing/selftests/bpf/prog_tests/changes_pkt_data.c | |
| parent | 7d0d673627e20cfa3b21a829a896ce03b58a4f1c (diff) | |
| download | lwn-ac6542ad92759cda383ad62b4e4cbfc28136abc1.tar.gz lwn-ac6542ad92759cda383ad62b4e4cbfc28136abc1.zip | |
bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs
bpf_prog_aux->func field might be NULL if program does not have
subprograms except for main sub-program. The fixed commit does
bpf_prog_aux->func access unconditionally, which might lead to null
pointer dereference.
The bug could be triggered by replacing the following BPF program:
SEC("tc")
int main_changes(struct __sk_buff *sk)
{
bpf_skb_pull_data(sk, 0);
return 0;
}
With the following BPF program:
SEC("freplace")
long changes_pkt_data(struct __sk_buff *sk)
{
return bpf_skb_pull_data(sk, 0);
}
bpf_prog_aux instance itself represents the main sub-program,
use this property to fix the bug.
Fixes: 81f6d0530ba0 ("bpf: check changes_pkt_data property for extension programs")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202412111822.qGw6tOyB-lkp@intel.com/
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20241212070711.427443-1-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'tools/testing/selftests/bpf/prog_tests/changes_pkt_data.c')
0 files changed, 0 insertions, 0 deletions