linux-kernel - Re: [PATCH v2] bpf: fix NULL pointer dereference in print_reg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <vgtxqzgqxtyfd3pzfngq4l43eeocpputr5syqstbnw2yibl6bv@3yep75dnifgp>
Date: Tue, 30 Sep 2025 23:51:56 +0530
From: Brahmajit Das <listout@...tout.xyz>
To: KaFai Wan <kafai.wan@...ux.dev>
Cc: Alexei Starovoitov <alexei.starovoitov@...il.com>, 
	syzbot+d36d5ae81e1b0a53ef58@...kaller.appspotmail.com, Andrii Nakryiko <andrii@...nel.org>, 
	Alexei Starovoitov <ast@...nel.org>, bpf <bpf@...r.kernel.org>, 
	Daniel Borkmann <daniel@...earbox.net>, Eduard <eddyz87@...il.com>, Hao Luo <haoluo@...gle.com>, 
	John Fastabend <john.fastabend@...il.com>, Jiri Olsa <jolsa@...nel.org>, KP Singh <kpsingh@...nel.org>, 
	LKML <linux-kernel@...r.kernel.org>, Martin KaFai Lau <martin.lau@...ux.dev>, 
	Stanislav Fomichev <sdf@...ichev.me>, Song Liu <song@...nel.org>, 
	syzkaller-bugs <syzkaller-bugs@...glegroups.com>, Yonghong Song <yonghong.song@...ux.dev>
Subject: Re: [PATCH v2] bpf: fix NULL pointer dereference in print_reg_state()

On 26.09.2025 18:36, KaFai Wan wrote:
> On Fri, 2025-09-26 at 06:34 +0530, Brahmajit Das wrote:
> > On 25.09.2025 23:31, KaFai Wan wrote:
> > > On Wed, 2025-09-24 at 23:58 +0530, Brahmajit Das wrote:
> > > > On 25.09.2025 01:38, KaFai Wan wrote:
> > > > > On Wed, 2025-09-24 at 21:10 +0530, Brahmajit Das wrote:
> > > > > > On 24.09.2025 09:32, Alexei Starovoitov wrote:
> > > > > > > On Wed, Sep 24, 2025 at 1:43 AM Brahmajit Das
> > > > > > > <listout@...tout.xyz>
> > > > > > > wrote:
> > > > > > > > 
> > > > > > > > Syzkaller reported a general protection fault due to a
> > > > > > > > NULL
> > > > > > > > pointer
> > > > > > > > dereference in print_reg_state() when accessing reg-
> > > > > > > > >map_ptr
> > > > > > > > without
> > > > > > > > checking if it is NULL.
> > > > > > > > 
...snip...
> 
> You should add a Fixes label in the commit log and add selftest for it
> in V3. 
> Fixes label is Fixes: aced132599b3 ("bpf: Add range tracking for
> BPF_NEG")
> For selftest you may check the test in verifier_value_illegal_alu.c and
> other files.  
> 
> The code in your next post would change the behavior of BPF_NEG and 
> BPF_END, you can run the selftest to check that.
> 

KaFai, I'm quite new to kernel development. I'm been trying to write a
selftest for this unfortunately been having a hard time. I would really
appreciate some help. For now I tried to create on from the initial test
you used to verify this bug i.e. r0 -= r0.

I have tried testing my changes via sending a pull request on the
kernel-patches/bpf repository, but seems like it's failing.
My pull request: https://github.com/kernel-patches/bpf/pull/9900

-- 
Regards,
listout