From: Yonghong Song <yhs@fb.com>
To: KP Singh <kpsingh@kernel.org>, <bpf@vger.kernel.org>
Cc: Gilad Reti <gilad.reti@gmail.com>,
Martin KaFai Lau <kafai@fb.com>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>
Subject: Re: [PATCH bpf v2 2/3] bpf: local storage helpers should check nullness of owner ptr passed
Date: Mon, 11 Jan 2021 23:25:47 -0800 [thread overview]
Message-ID: <f4e35851-7273-3b9f-3b11-e2e7ae05f67c@fb.com> (raw)
In-Reply-To: <20210111212340.86393-3-kpsingh@kernel.org>
On 1/11/21 1:23 PM, KP Singh wrote:
> The verifier allows ARG_PTR_TO_BTF_ID helper arguments to be NULL, so
> helper implementations need to check this before dereferencing them.
> This was already fixed for the socket storage helpers but not for task
> and inode.
>
> The issue can be reproduced by attaching an LSM program to
> inode_rename hook (called when moving files) which tries to get the
> inode of the new file without checking for its nullness and then trying
> to move an existing file to a new path:
>
> mv existing_file new_file_does_not_exist
>
> The report including the sample program and the steps for reproducing
> the bug:
>
> https://lore.kernel.org/bpf/CANaYP3HWkH91SN=wTNO9FL_2ztHfqcXKX38SSE-JJ2voh+vssw@mail.gmail.com
>
> Fixes: 4cf1bc1f1045 ("bpf: Implement task local storage")
> Fixes: 8ea636848aca ("bpf: Implement bpf_local_storage for inodes")
> Reported-by: Gilad Reti <gilad.reti@gmail.com>
> Acked-by: Martin KaFai Lau <kafai@fb.com>
> Signed-off-by: KP Singh <kpsingh@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
next prev parent reply other threads:[~2021-01-12 7:26 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-11 21:23 [PATCH bpf v2 0/3] Fix local storage helper OOPs KP Singh
2021-01-11 21:23 ` [PATCH bpf v2 1/3] bpf: update local storage test to check handling of null ptrs KP Singh
2021-01-12 7:24 ` Yonghong Song
2021-01-12 7:35 ` KP Singh
2021-01-11 21:23 ` [PATCH bpf v2 2/3] bpf: local storage helpers should check nullness of owner ptr passed KP Singh
2021-01-12 7:25 ` Yonghong Song [this message]
2021-01-11 21:23 ` [PATCH bpf v2 3/3] bpf: Fix typo in bpf_inode_storage.c KP Singh
2021-01-12 7:26 ` Yonghong Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f4e35851-7273-3b9f-3b11-e2e7ae05f67c@fb.com \
--to=yhs@fb.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=gilad.reti@gmail.com \
--cc=kafai@fb.com \
--cc=kpsingh@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.