linux-kernel - Re: [PATCH] libbpf:fix use empty function pointers in ringbuf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230608125820.726340-1-zhangmingyi5@huawei.com>
Date:   Thu, 8 Jun 2023 20:58:20 +0800
From:   zhangmingyi <zhangmingyi5@...wei.com>
To:     <sdf@...gle.com>
CC:     <andrii@...nel.org>, <ast@...nel.org>, <bpf@...r.kernel.org>,
        <daniel@...earbox.net>, <davem@...emloft.net>,
        <edumazet@...gle.com>, <hsinweih@....edu>, <jakub@...udflare.com>,
        <john.fastabend@...il.com>, <kongweibin2@...wei.com>,
        <kuba@...nel.org>, <linux-kernel@...r.kernel.org>,
        <liuxin350@...wei.com>, <netdev@...r.kernel.org>,
        <pabeni@...hat.com>,
        <syzbot+49f6cef45247ff249498@...kaller.appspotmail.com>,
        <syzkaller-bugs@...glegroups.com>, <wuchangye@...wei.com>,
        <xiesongyang@...wei.com>, <yanan@...wei.com>,
        <zhangmingyi5@...wei.com>
Subject: Re: [PATCH] libbpf:fix use empty function pointers in ringbuf_poll

On 06/06,Stanislav Fomichev wrote:

> On 06/05, Xin Liu wrote:
> > From: zhangmingyi <zhangmingyi5@...wei.com>
> 
> > The sample_cb of the ring_buffer__new interface can transfer NULL. However,
> > the system does not check whether sample_cb is NULL during 
> > ring_buffer__poll, null pointer is used.

> What is the point of calling ring_buffer__new with sample_cb == NULL?

Yes, as you said, passing sample_cb in ring_buffer__new to NULL doesn't 
make sense, and few people use it that way, but that doesn't prevent this 
from being a allowed and supported scenario. And when ring_buffer__poll is 
called, it leads to a segmentation fault (core dump), which I think needs 
to be fixed to ensure the security quality of libbpf.