linux-kernel - Re: [PATCH v2] bpf: fix NULL pointer dereference in print_reg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9051652cf548271da9c349758cbd70aaa3cee444.camel@linux.dev>
Date: Thu, 25 Sep 2025 01:38:22 +0800
From: KaFai Wan <kafai.wan@...ux.dev>
To: Brahmajit Das <listout@...tout.xyz>, Alexei Starovoitov
	 <alexei.starovoitov@...il.com>
Cc: syzbot+d36d5ae81e1b0a53ef58@...kaller.appspotmail.com, Andrii Nakryiko
 <andrii@...nel.org>, Alexei Starovoitov <ast@...nel.org>, bpf
 <bpf@...r.kernel.org>, Daniel Borkmann <daniel@...earbox.net>, Eduard
 <eddyz87@...il.com>, Hao Luo <haoluo@...gle.com>, John Fastabend
 <john.fastabend@...il.com>, Jiri Olsa <jolsa@...nel.org>, KP Singh
 <kpsingh@...nel.org>, LKML <linux-kernel@...r.kernel.org>, Martin KaFai Lau
 <martin.lau@...ux.dev>, Stanislav Fomichev <sdf@...ichev.me>, Song Liu
 <song@...nel.org>, syzkaller-bugs <syzkaller-bugs@...glegroups.com>, 
 Yonghong Song <yonghong.song@...ux.dev>
Subject: Re: [PATCH v2] bpf: fix NULL pointer dereference in
 print_reg_state()

On Wed, 2025-09-24 at 21:10 +0530, Brahmajit Das wrote:
> On 24.09.2025 09:32, Alexei Starovoitov wrote:
> > On Wed, Sep 24, 2025 at 1:43 AM Brahmajit Das <listout@...tout.xyz>
> > wrote:
> > > 
> > > Syzkaller reported a general protection fault due to a NULL
> > > pointer
> > > dereference in print_reg_state() when accessing reg->map_ptr
> > > without
> > > checking if it is NULL.
> > > 
> ...snip...
> > > -       if (type_is_map_ptr(t)) {
> > > +       if (type_is_map_ptr(t) && reg->map_ptr) {
> > 
> > You ignored earlier feedback.
> > Fix the root cause, not the symptom.
> > 
> > pw-bot: cr
> 
> I'm not sure if I'm headed the write direction but it seems like in
> check_alu_op, we are calling adjust_scalar_min_max_vals when we get
> an
> BPF_NEG as opcode. Which has a call to __mark_reg_known when opcode
> is
> BPF_NEG. And __mark_reg_known clears map_ptr with
> 
> 	/* Clear off and union(map_ptr, range) */
> 	memset(((u8 *)reg) + sizeof(reg->type), 0,
> 	       offsetof(struct bpf_reg_state, var_off) - sizeof(reg-
> >type));
> 

I think you are right. The following code can reproduce the error.

	asm volatile ("					\
	r0 = %[map_hash_48b] ll;			\
	r0 = -r0;					\
	exit;						\
"	:
	: __imm_addr(map_hash_48b)
	: __clobber_all);


BPF_NEG calls __mark_reg_known(dst_reg, 0) which clears the 'off' and
'union(map_ptr, range)' of dst_reg, but keeps the 'type', which is
CONST_PTR_TO_MAP.

Perhaps we can only allow the SCALAR_VALUE type to run BPF_NEG as an
opcode, while for other types same as the before BPF_NEG.

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index e892df386eed..dbf9f1efc6e7 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -15346,13 +15346,15 @@ static bool
is_safe_to_compute_dst_reg_range(struct bpf_insn *insn,
 	switch (BPF_OP(insn->code)) {
 	case BPF_ADD:
 	case BPF_SUB:
-	case BPF_NEG:
 	case BPF_AND:
 	case BPF_XOR:
 	case BPF_OR:
 	case BPF_MUL:
 		return true;
 
+	case BPF_NEG:
+		return base_type(src_reg->type) == SCALAR_VALUE;
+


-- 
Thanks,
KaFai