Re: [PATCH bpf-next] bpf: Fix NULL pointer dereference when registering bpf trampoline

[Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx>]

On Thu, Jul 28, 2022 at 6:31 AM Jiri Olsa <olsajiri@xxxxxxxxx> wrote:
>
> On Thu, Jul 28, 2022 at 08:56:27PM +0800, Xu Kuohai wrote:
> > On 7/28/2022 8:27 PM, Jiri Olsa wrote:
> > > On Thu, Jul 28, 2022 at 07:40:48AM -0400, Xu Kuohai wrote:
> > > > From: Xu Kuohai <xukuohai@xxxxxxxxxx>
> > >
> > > SNIP
> > >
> > > >
> > > > It's caused by a NULL tr->fops passed to ftrace_set_filter_ip(). tr->fops
> > > > is initialized to NULL and is assigned to an allocated memory address if
> > > > CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is enabled. Since there is no
> > > > direct call on arm64 yet, the config can't be enabled.
> > > >
> > > > To fix it, call ftrace_set_filter_ip() only if tr->fops is not NULL.
> > > >
> > > > Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)")
> > > > Reported-by: Bruno Goncalves <bgoncalv@xxxxxxxxxx>
> > > > Signed-off-by: Xu Kuohai <xukuohai@xxxxxxxxxx>
> > > > Tested-by: Bruno Goncalves <bgoncalv@xxxxxxxxxx>
> > > > Acked-by: Song Liu <songliubraving@xxxxxx>
> > > > ---
> > > >   kernel/bpf/trampoline.c | 11 +++++++++--
> > > >   1 file changed, 9 insertions(+), 2 deletions(-)
> > > >
> > > > diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> > > > index 42e387a12694..0d5a9e0b9a7b 100644
> > > > --- a/kernel/bpf/trampoline.c
> > > > +++ b/kernel/bpf/trampoline.c
> > > > @@ -255,8 +255,15 @@ static int register_fentry(struct bpf_trampoline *tr, void *new_addr)
> > > >                   return -ENOENT;
> > > >           if (tr->func.ftrace_managed) {
> > > > -         ftrace_set_filter_ip(tr->fops, (unsigned long)ip, 0, 0);
> > > > -         ret = register_ftrace_direct_multi(tr->fops, (long)new_addr);
> > > > +         if (tr->fops)
> > > > +                 ret = ftrace_set_filter_ip(tr->fops, (unsigned long)ip,
> > > > +                                            0, 0);
> > > > +         else
> > > > +                 ret = -ENOTSUPP;
> > > > +
> > > > +         if (!ret)
> > > > +                 ret = register_ftrace_direct_multi(tr->fops,
> > > > +                                                    (long)new_addr);
> > > >           } else {
> > > >                   ret = bpf_arch_text_poke(ip, BPF_MOD_CALL, NULL, new_addr);
> > > >           }
> > >
> > > do we need to do the same also in unregister_fentry and modify_fentry ?
> > >
> >
> > No need for now, this is the only place where we call ftrace_set_filter_ip().
> >
> > tr->fops is passed to ftrace_set_filter_ip() and *ftrace_direct_multi()
> > functions, and when CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is not enabled,
> > the *ftrace_direct_multi()s do nothing except returning an error code, so
> > it's safe to pass NULL to them.
>
> ok, makes sense
>
> Acked-by: Jiri Olsa <jolsa@xxxxxxxxxx>
>

I've simplified this to

diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index 7ec7e23559ad..c122d8b3ddc9 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -248,8 +248,11 @@ static int register_fentry(struct bpf_trampoline
*tr, void *new_addr)
        int ret;

        faddr = ftrace_location((unsigned long)ip);
-       if (faddr)
+       if (faddr) {
+               if (!tr->fops)
+                       return -ENOTSUPP;
                tr->func.ftrace_managed = true;
+       }


and pushed to bpf-next. Thanks.


> jirka