• Daniel Borkmann's avatar
    bpf: fix null pointer deref in bpf_prog_test_run_xdp · 65073a67
    Daniel Borkmann authored
    syzkaller was able to generate the following XDP program ...
    
      (18) r0 = 0x0
      (61) r5 = *(u32 *)(r1 +12)
      (04) (u32) r0 += (u32) 0
      (95) exit
    
    ... and trigger a NULL pointer dereference in ___bpf_prog_run()
    via bpf_prog_test_run_xdp() where this was attempted to run.
    
    Reason is that recent xdp_rxq_info addition to XDP programs
    updated all drivers, but not bpf_prog_test_run_xdp(), where
    xdp_buff is set up. Thus when context rewriter does the deref
    on the netdev it's NULL at runtime. Fix it by using xdp_rxq
    from loopback dev. __netif_get_rx_queue() helper can also be
    reused in various other locations later on.
    
    Fixes: 02dd3291 ("bpf: finally expose xdp_rxq_info to XDP bpf-programs")
    Reported-by: syzbot+1eb094057b338eb1fc00@syzkaller.appspotmail.com
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Cc: Jesper Dangaard Brouer <brouer@redhat.com>
    Acked-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    65073a67
test_run.c 4.51 KB