Re: [PATCH bpf-next] bpf: Fix NULL pointer dereference when registering bpf trampoline

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 7/28/2022 8:27 PM, Jiri Olsa wrote:
On Thu, Jul 28, 2022 at 07:40:48AM -0400, Xu Kuohai wrote:
From: Xu Kuohai <xukuohai@xxxxxxxxxx>

SNIP


It's caused by a NULL tr->fops passed to ftrace_set_filter_ip(). tr->fops
is initialized to NULL and is assigned to an allocated memory address if
CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is enabled. Since there is no
direct call on arm64 yet, the config can't be enabled.

To fix it, call ftrace_set_filter_ip() only if tr->fops is not NULL.

Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)")
Reported-by: Bruno Goncalves <bgoncalv@xxxxxxxxxx>
Signed-off-by: Xu Kuohai <xukuohai@xxxxxxxxxx>
Tested-by: Bruno Goncalves <bgoncalv@xxxxxxxxxx>
Acked-by: Song Liu <songliubraving@xxxxxx>
---
  kernel/bpf/trampoline.c | 11 +++++++++--
  1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index 42e387a12694..0d5a9e0b9a7b 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -255,8 +255,15 @@ static int register_fentry(struct bpf_trampoline *tr, void *new_addr)
  		return -ENOENT;
if (tr->func.ftrace_managed) {
-		ftrace_set_filter_ip(tr->fops, (unsigned long)ip, 0, 0);
-		ret = register_ftrace_direct_multi(tr->fops, (long)new_addr);
+		if (tr->fops)
+			ret = ftrace_set_filter_ip(tr->fops, (unsigned long)ip,
+						   0, 0);
+		else
+			ret = -ENOTSUPP;
+
+		if (!ret)
+			ret = register_ftrace_direct_multi(tr->fops,
+							   (long)new_addr);
  	} else {
  		ret = bpf_arch_text_poke(ip, BPF_MOD_CALL, NULL, new_addr);
  	}

do we need to do the same also in unregister_fentry and modify_fentry ?


No need for now, this is the only place where we call ftrace_set_filter_ip().

tr->fops is passed to ftrace_set_filter_ip() and *ftrace_direct_multi()
functions, and when CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is not enabled,
the *ftrace_direct_multi()s do nothing except returning an error code, so
it's safe to pass NULL to them.

jirka




[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]


  Powered by Linux