All of lore.kernel.org
 help / color / mirror / Atom feed
From: Daniel Borkmann <daniel@iogearbox.net>
To: Alexei Starovoitov <ast@kernel.org>, davem@davemloft.net
Cc: netdev@vger.kernel.org, kernel-team@fb.com
Subject: Re: [PATCH bpf-next] bpf: fix verifier GPF in kmalloc failure path
Date: Mon, 8 Jan 2018 18:33:21 +0100	[thread overview]
Message-ID: <039f10d5-e625-1926-a2bf-0bb9313d2c37@iogearbox.net> (raw)
In-Reply-To: <20180108155117.2203858-1-ast@kernel.org>

On 01/08/2018 04:51 PM, Alexei Starovoitov wrote:
> From: Alexei Starovoitov <ast@fb.com>
> 
> syzbot reported the following panic in the verifier triggered
> by kmalloc error injection:
> 
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> RIP: 0010:copy_func_state kernel/bpf/verifier.c:403 [inline]
> RIP: 0010:copy_verifier_state+0x364/0x590 kernel/bpf/verifier.c:431
> Call Trace:
>  pop_stack+0x8c/0x270 kernel/bpf/verifier.c:449
>  push_stack kernel/bpf/verifier.c:491 [inline]
>  check_cond_jmp_op kernel/bpf/verifier.c:3598 [inline]
>  do_check+0x4b60/0xa050 kernel/bpf/verifier.c:4731
>  bpf_check+0x3296/0x58c0 kernel/bpf/verifier.c:5489
>  bpf_prog_load+0xa2a/0x1b00 kernel/bpf/syscall.c:1198
>  SYSC_bpf kernel/bpf/syscall.c:1807 [inline]
>  SyS_bpf+0x1044/0x4420 kernel/bpf/syscall.c:1769
> 
> when copy_verifier_state() aborts in the middle due to kmalloc failure
> some of the frames could have been partially copied while
> current free_verifier_state() loop
> for (i = 0; i <= state->curframe; i++)
> assumed that all frames are non-null.
> Simply fix it by adding 'if (!state)' to free_func_state().
> Also avoid stressing copy frame logic more if kzalloc fails
> in push_stack() free env->cur_state right away.
> 
> Reported-by: syzbot+32ac5a3e473f2e01cfc7@syzkaller.appspotmail.com
> Reported-by: syzbot+fa99e24f3c29d269a7d5@syzkaller.appspotmail.com
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Applied to bpf-next with Fixes tags, thanks Alexei!

  reply	other threads:[~2018-01-08 17:33 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-01-08 15:51 [PATCH bpf-next] bpf: fix verifier GPF in kmalloc failure path Alexei Starovoitov
2018-01-08 17:33 ` Daniel Borkmann [this message]
  -- strict thread matches above, loose matches on Subject: below --
2018-01-05 20:57 Alexei Starovoitov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=039f10d5-e625-1926-a2bf-0bb9313d2c37@iogearbox.net \
    --to=daniel@iogearbox.net \
    --cc=ast@kernel.org \
    --cc=davem@davemloft.net \
    --cc=kernel-team@fb.com \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.