linux-kernel - Re: [syzbot] [bpf?] [net?] general protection fault in dev_map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 16 Apr 2024 22:55:00 +0200
From: Toke Høiland-Jørgensen <toke@...nel.org>
To: syzbot <syzbot+af9492708df9797198d6@...kaller.appspotmail.com>,
 andrii@...nel.org, ast@...nel.org, bpf@...r.kernel.org,
 daniel@...earbox.net, davem@...emloft.net, eadavis@...com,
 eddyz87@...il.com, haoluo@...gle.com, hawk@...nel.org,
 john.fastabend@...il.com, jolsa@...nel.org, kpsingh@...nel.org,
 kuba@...nel.org, linux-kernel@...r.kernel.org, martin.lau@...ux.dev,
 netdev@...r.kernel.org, sdf@...gle.com, song@...nel.org,
 syzkaller-bugs@...glegroups.com, yonghong.song@...ux.dev
Subject: Re: [syzbot] [bpf?] [net?] general protection fault in dev_map_enqueue

syzbot <syzbot+af9492708df9797198d6@...kaller.appspotmail.com> writes:

> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in dev_map_enqueue

Alright, trying a different thing (not a correct patch, just testing a theory):

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git 443574b03387

diff --git a/net/core/filter.c b/net/core/filter.c
index 786d792ac816..c2fd4f67766f 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4301,8 +4301,9 @@ void bpf_clear_redirect_map(struct bpf_map *map)
                 * cmpxchg() to make sure it hasn't been changed in
                 * the meantime by remote CPU.
                 */
-               if (unlikely(READ_ONCE(ri->map) == map))
-                       cmpxchg(&ri->map, map, NULL);
+               if (unlikely(READ_ONCE(ri->map) == map) &&
+                   cmpxchg(&ri->map, map, NULL) == map)
+                       WRITE_ONCE(ri->map_type, BPF_MAP_TYPE_UNSPEC);
        }
 }