linux-kernel - Re: [syzbot] [bpf?] general protection fault in bpf_prog_offload_verifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZPjGPjbxazLkRkEW@google.com>
Date:   Wed, 6 Sep 2023 11:34:38 -0700
From:   Stanislav Fomichev <sdf@...gle.com>
To:     Eduard Zingerman <eddyz87@...il.com>
Cc:     Jakub Kicinski <kuba@...nel.org>,
        syzbot <syzbot+291100dcb32190ec02a8@...kaller.appspotmail.com>,
        andrii@...nel.org, ast@...nel.org, bpf@...r.kernel.org,
        daniel@...earbox.net, davem@...emloft.net, haoluo@...gle.com,
        hawk@...nel.org, john.fastabend@...il.com, jolsa@...nel.org,
        kpsingh@...nel.org, linux-kernel@...r.kernel.org,
        martin.lau@...ux.dev, netdev@...r.kernel.org, song@...nel.org,
        syzkaller-bugs@...glegroups.com, yonghong.song@...ux.dev
Subject: Re: [syzbot] [bpf?] general protection fault in bpf_prog_offload_verifier_prep

On 09/06, Eduard Zingerman wrote:
> On Wed, 2023-09-06 at 07:57 -0700, Jakub Kicinski wrote:
> > On Wed, 06 Sep 2023 16:50:23 +0300 Eduard Zingerman wrote:
> > > diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
> > > index 3e4f2ec1af06..302e38bffffa 100644
> > > --- a/kernel/bpf/offload.c
> > > +++ b/kernel/bpf/offload.c
> > > @@ -199,12 +199,11 @@ static int __bpf_prog_dev_bound_init(struct bpf_prog *prog, struct net_device *n
> > >         offload->netdev = netdev;
> > >  
> > >         ondev = bpf_offload_find_netdev(offload->netdev);
> > > +       if (bpf_prog_is_offloaded(prog->aux) && (!ondev || !ondev->offdev)) {
> > > +               err = -EINVAL;
> > > +               goto err_free;
> > > +       }
> > >         if (!ondev) {
> > > -               if (bpf_prog_is_offloaded(prog->aux)) {
> > > -                       err = -EINVAL;
> > > -                       goto err_free;
> > > -               }
> > > -
> > >                 /* When only binding to the device, explicitly
> > >                  * create an entry in the hashtable.
> > >                  */
> > 
> > LGTM, FWIW.
> 
> Thanks, I'll wrap it up as a proper patch with a test.

LGTM as well, thanks!