[PATCH v2] Fixes the null pointer deferences in nsim_bpf
From: Dipendra Khadka <hidden>
Date: 2023-11-10 17:45:36
Also in:
linux-kernel-mentees, lkml
Subsystem:
netdevsim, networking drivers, the rest · Maintainers:
Jakub Kicinski, Andrew Lunn, "David S. Miller", Eric Dumazet, Paolo Abeni, Linus Torvalds
Syzkaller found a null pointer dereference in nsim_bpf originating from the lack of a null check for state. This patch fixes the issue by adding a check for state in two functions nsim_prog_set_loaded() and nsim_setup_prog_hw_checks() Reported-by: syzbot+44c2416196b7c607f226@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com./bug?extid=44c2416196b7c607f226 Fixes: 31d3ad832948 ("netdevsim: add bpf offload support") Signed-off-by: Dipendra Khadka <redacted> --- drivers/net/netdevsim/bpf.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
index f60eb97e3a62..5d755da3c736 100644
--- a/drivers/net/netdevsim/bpf.c
+++ b/drivers/net/netdevsim/bpf.c@@ -97,7 +97,8 @@ static void nsim_prog_set_loaded(struct bpf_prog *prog, bool loaded) return; state = prog->aux->offload->dev_priv; - state->is_loaded = loaded; + if (state) + state->is_loaded = loaded; } static int
@@ -317,9 +318,11 @@ nsim_setup_prog_hw_checks(struct netdevsim *ns, struct netdev_bpf *bpf) } state = bpf->prog->aux->offload->dev_priv; - if (WARN_ON(strcmp(state->state, "xlated"))) { - NSIM_EA(bpf->extack, "offloading program in bad state"); - return -EINVAL; + if (state) { + if (WARN_ON(strcmp(state->state, "xlated"))) { + NSIM_EA(bpf->extack, "offloading program in bad state"); + return -EINVAL; + } } return 0; }
--
2.34.1