Re: [PATCH bpf v2] bpf: Fix NULL pointer dereference in __bpf_sk_storage_map_seq_show

在 2026/9/11 22:03, Cen Zhang (Microsoft Security FORGE Labs) 写道:

Iterating a sk_storage map is a two-stage operation:
bpf_sk_storage_map_seq_find_next() returns a selem, then
__bpf_sk_storage_map_seq_show() uses it. The latter re-reads
selem->local_storage via rcu_dereference() without checking for NULL.
A concurrent socket close can unlink the selem and clear that pointer
between the two stages, causing a NULL dereference of sk_storage->owner.

Oops: general protection fault, probably for non-canonical
    address 0xdffffc0000000011
   net/core/bpf_sk_storage.c:809 __bpf_sk_storage_map_seq_show()
   bpf_seq_read+0x366/0x1120
   vfs_read+0x174/0xa50
   ksys_read+0xfc/0x1d0

Return SEQ_SKIP if the re-read yields NULL. This prevents the dereference
and tells bpf_seq_read() that the stale element was skipped, so it does
not consume an iterator sequence number without running the BPF program.

Fixes: 0be08389c7f2 ("bpf: Switch to bpf_selem_unlink_nofail in bpf_local_storage_{map_free, destroy}")
Reported-by: Xiang Mei (Microsoft) <redacted>
Closes: https://lore.kernel.org/all/20260827051859.45511-1-blbllhy@gmail.com/ (local)
Suggested-by: Amery Hung <redacted>
Suggested-by: Xuanqiang Luo <redacted>
Link: https://lore.kernel.org/all/CAMB2axNFOC9G2RwOCnsWDth83REMWnmPE8gxMwbLYoGusw9miA@mail.gmail.com/ (local)
Link: https://lore.kernel.org/all/c3f2a61d-d5bc-454c-987d-717b5f8c8809@linux.dev/ (local)
Cc: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft Security FORGE Labs) <redacted>
Assisted-by: Copilot (Grok 4.6)

Reviewed-by: Xuanqiang Luo<redacted>

Thanks,
Xuanqiang