TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
65073a6733
twx-linux/net
History
Daniel Borkmann 65073a6733 bpf: fix null pointer deref in bpf_prog_test_run_xdp 
syzkaller was able to generate the following XDP program ...

  (18) r0 = 0x0
  (61) r5 = *(u32 *)(r1 +12)
  (04) (u32) r0 += (u32) 0
  (95) exit

... and trigger a NULL pointer dereference in ___bpf_prog_run()
via bpf_prog_test_run_xdp() where this was attempted to run.

Reason is that recent xdp_rxq_info addition to XDP programs
updated all drivers, but not bpf_prog_test_run_xdp(), where
xdp_buff is set up. Thus when context rewriter does the deref
on the netdev it's NULL at runtime. Fix it by using xdp_rxq
from loopback dev. __netif_get_rx_queue() helper can also be
reused in various other locations later on.

Fixes: 02dd3291b2f0 ("bpf: finally expose xdp_rxq_info to XDP bpf-programs")
Reported-by: syzbot+1eb094057b338eb1fc00@syzkaller.appspotmail.com
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-02-01 07:43:56 -08:00
..
6lowpan
9p Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2018-01-30 17:58:07 -08:00
802 treewide: setup_timer() -> timer_setup() 2017-11-21 15:57:07 -08:00
8021q net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
appletalk net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
atm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
ax25 net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
batman-adv Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
bluetooth Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
bpf bpf: fix null pointer deref in bpf_prog_test_run_xdp 2018-02-01 07:43:56 -08:00
bridge bridge: return boolean instead of integer in br_multicast_is_router 2018-01-22 16:13:20 -05:00
caif Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
can can: migrate documentation to restructured text 2018-01-26 10:46:44 +01:00
ceph We have a set of file locking improvements from Zheng, rbd rw/ro 2017-11-21 05:38:32 -10:00
core Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
dcb
dccp Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
decnet Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
dns_resolver
dsa net: dsa: Support internal phy on 'cpu' port 2018-01-23 19:22:38 -05:00
ethernet
hsr
ieee802154
ife
ipv4 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
ipv6 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
ipx net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
iucv net: annotate ->poll() instances 2017-11-27 16:20:04 -05:00
kcm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-01-24 23:44:15 -05:00
key af_key: Fix memory leak in key_notify_policy. 2018-01-10 09:45:11 +01:00
l2tp l2tp: remove switch block in l2tp_nl_cmd_session_create() 2018-01-19 15:10:23 -05:00
l3mdev
lapb treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts 2017-11-21 16:35:54 -08:00
llc net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
mac80211 debugfs_sta: Remove unneeded semicolons 2018-01-22 14:03:28 +01:00
mac802154
mpls net: use rtnl_register_module where needed 2017-12-04 11:32:39 -05:00
ncsi net/ncsi: Don't take any action on HNCDSC AEN 2017-12-18 14:50:11 -05:00
netfilter Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
netlabel net/netlabel: Add list_next_rcu() in rcu_dereference(). 2017-11-18 10:32:41 +09:00
netlink Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-01-19 22:59:33 -05:00
netrom net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
nfc net: annotate ->poll() instances 2017-11-27 16:20:04 -05:00
nsh
openvswitch openvswitch: meter: Use 64-bit arithmetic instead of 32-bit 2018-01-31 10:26:30 -05:00
packet Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
phonet Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
psample
qrtr net: use rtnl_register_module where needed 2017-12-04 11:32:39 -05:00
rds Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
rfkill net: annotate ->poll() instances 2017-11-27 16:20:04 -05:00
rose net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
rxrpc Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
sched net/sched: kconfig: Remove blank help texts 2018-01-31 10:26:30 -05:00
sctp Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
smc Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
strparser strparser: Call sock_owned_by_user_nocheck 2017-12-28 14:28:22 -05:00
sunrpc NFS client updates for Linux 4.16 2018-01-30 19:03:48 -08:00
switchdev
tipc Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
tls tls: Add support for encryption using async offload accelerator 2018-01-31 10:26:30 -05:00
unix Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
vmw_vsock Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2018-01-30 17:58:07 -08:00
wimax
wireless lift handling of SIOCIW... out of dev_ioctl() 2018-01-24 19:13:45 -05:00
x25 treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts 2017-11-21 16:35:54 -08:00
xfrm Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 2018-01-26 10:22:53 -05:00
compat.c
Kconfig netfilter: don't allocate space for arp/bridge hooks unless needed 2018-01-08 18:01:11 +01:00
Makefile
socket.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
sysctl_net.c