linux-kernel - Re: [syzbot] [bpf?] WARNING in do_misc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAADnVQL_OnKvm2-=FxzrFqh5NxWNory09GKX5vT+Qrcj_RuJVA@mail.gmail.com>
Date: Mon, 4 Aug 2025 09:05:23 -0700
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: syzbot <syzbot+a9ed3d9132939852d0df@...kaller.appspotmail.com>
Cc: Andrii Nakryiko <andrii@...nel.org>, Alexei Starovoitov <ast@...nel.org>, bpf <bpf@...r.kernel.org>, 
	Daniel Borkmann <daniel@...earbox.net>, Eduard <eddyz87@...il.com>, Hao Luo <haoluo@...gle.com>, 
	John Fastabend <john.fastabend@...il.com>, Jiri Olsa <jolsa@...nel.org>, 
	KP Singh <kpsingh@...nel.org>, LKML <linux-kernel@...r.kernel.org>, 
	Martin KaFai Lau <martin.lau@...ux.dev>, Stanislav Fomichev <sdf@...ichev.me>, Song Liu <song@...nel.org>, 
	syzkaller-bugs <syzkaller-bugs@...glegroups.com>, Yonghong Song <yonghong.song@...ux.dev>
Subject: Re: [syzbot] [bpf?] WARNING in do_misc_fixups

On Sun, Aug 3, 2025 at 10:08 PM syzbot
<syzbot+a9ed3d9132939852d0df@...kaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    a6923c06a3b2 Merge tag 'bpf-fixes' of git://git.kernel.org..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1561dcf0580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f89bb9497754f485
> dashboard link: https://syzkaller.appspot.com/bug?extid=a9ed3d9132939852d0df
> compiler:       aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> userspace arch: arm64
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=165d0aa2580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=117bd834580000
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/fa3fbcfdac58/non_bootable_disk-a6923c06.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/9862ca8219e0/vmlinux-a6923c06.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/042ebe320cfd/Image-a6923c06.gz.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+a9ed3d9132939852d0df@...kaller.appspotmail.com
>
> ------------[ cut here ]------------
> verifier bug: not inlined functions bpf_probe_read_kernel_str#115 is missing func(1)
> WARNING: CPU: 1 PID: 3594 at kernel/bpf/verifier.c:22838 do_misc_fixups+0x1784/0x1ab4 kernel/bpf/verifier.c:22838

This is an odd config with BPF_SYSCALL=y and BPF_EVENTS=n.
One approach to mitigate this is to add a check that fn->func is valid
in get_helper_proto().