Re: [PATCH] Fixes the null pointer deferences in nsim_bpf
From: Eric Dumazet <edumazet@google.com>
Date: 2023-11-10 17:57:10
Also in:
linux-kernel-mentees, lkml
On Fri, Nov 10, 2023 at 9:45 AM Dipendra Khadka [off-list ref] wrote:
Syzkaller found a null pointer dereference in nsim_bpf originating from the lack of a null check for state. This patch fixes the issue by adding a check for state in two functions nsim_prog_set_loaded and nsim_setup_prog_hw_checks Reported-by: syzbot+44c2416196b7c607f226@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com./bug?extid=44c2416196b7c607f226
Please add a Fixes: tag, and remove this empty line, thanks.
quoted hunk ↗ jump to hunk
Signed-off-by: Dipendra Khadka <redacted> --- drivers/net/netdevsim/bpf.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c index f60eb97e3a62..e407efb0e3de 100644 --- a/drivers/net/netdevsim/bpf.c +++ b/drivers/net/netdevsim/bpf.c@@ -97,7 +97,8 @@ static void nsim_prog_set_loaded(struct bpf_prog *prog, bool loaded) return; state = prog->aux->offload->dev_priv; - state->is_loaded = loaded; + if (state) + state->is_loaded = loaded; } static int@@ -317,10 +318,12 @@ nsim_setup_prog_hw_checks(struct netdevsim *ns, struct netdev_bpf *bpf) } state = bpf->prog->aux->offload->dev_priv; - if (WARN_ON(strcmp(state->state, "xlated"))) { - NSIM_EA(bpf->extack, "offloading program in bad state"); - return -EINVAL; - } + if (state) { + if (WARN_ON(strcmp(state->state, "xlated"))) { + NSIM_EA(bpf->extack, "offloading program in bad state"); + return -EINVAL; + } + } return 0; } --2.34.1