* [PATCH bpf-next] bpf: Fix NULL pointer dereference when registering bpf trampoline
@ 2022-07-28 11:40 Xu Kuohai
2022-07-28 12:27 ` Jiri Olsa
2022-07-29 22:00 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 6+ messages in thread
From: Xu Kuohai @ 2022-07-28 11:40 UTC (permalink / raw)
To: bpf, netdev; +Cc: Bruno Goncalves, Song Liu
From: Xu Kuohai <xukuohai@huawei.com>
A panic was reported on arm64:
[ 44.517109] audit: type=1334 audit(1658859870.268:59): prog-id=19 op=LOAD
[ 44.622031] Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000010
[ 44.624321] Mem abort info:
[ 44.625049] ESR = 0x0000000096000004
[ 44.625935] EC = 0x25: DABT (current EL), IL = 32 bits
[ 44.627182] SET = 0, FnV = 0
[ 44.627930] EA = 0, S1PTW = 0
[ 44.628684] FSC = 0x04: level 0 translation fault
[ 44.629788] Data abort info:
[ 44.630474] ISV = 0, ISS = 0x00000004
[ 44.631362] CM = 0, WnR = 0
[ 44.632041] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000100ab5000
[ 44.633494] [0000000000000010] pgd=0000000000000000, p4d=0000000000000000
[ 44.635202] Internal error: Oops: 96000004 [#1] SMP
[ 44.636452] Modules linked in: xfs crct10dif_ce ghash_ce virtio_blk
virtio_console virtio_mmio qemu_fw_cfg
[ 44.638713] CPU: 2 PID: 1 Comm: systemd Not tainted 5.19.0-rc7 #1
[ 44.640164] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
[ 44.641799] pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 44.643404] pc : ftrace_set_filter_ip+0x24/0xa0
[ 44.644659] lr : bpf_trampoline_update.constprop.0+0x428/0x4a0
[ 44.646118] sp : ffff80000803b9f0
[ 44.646950] x29: ffff80000803b9f0 x28: ffff0b5d80364400 x27: ffff80000803bb48
[ 44.648721] x26: ffff8000085ad000 x25: ffff0b5d809d2400 x24: 0000000000000000
[ 44.650493] x23: 00000000ffffffed x22: ffff0b5dd7ea0900 x21: 0000000000000000
[ 44.652279] x20: 0000000000000000 x19: 0000000000000000 x18: ffffffffffffffff
[ 44.654067] x17: 0000000000000000 x16: 0000000000000000 x15: ffffffffffffffff
[ 44.655787] x14: ffff0b5d809d2498 x13: ffff0b5d809d2432 x12: 0000000005f5e100
[ 44.657535] x11: abcc77118461cefd x10: 000000000000005f x9 : ffffa7219cb5b190
[ 44.659254] x8 : ffffa7219c8e0000 x7 : 0000000000000000 x6 : ffffa7219db075e0
[ 44.661066] x5 : ffffa7219d3130e0 x4 : ffffa7219cab9da0 x3 : 0000000000000000
[ 44.662837] x2 : 0000000000000000 x1 : ffffa7219cb7a5c0 x0 : 0000000000000000
[ 44.664675] Call trace:
[ 44.665274] ftrace_set_filter_ip+0x24/0xa0
[ 44.666327] bpf_trampoline_update.constprop.0+0x428/0x4a0
[ 44.667696] __bpf_trampoline_link_prog+0xcc/0x1c0
[ 44.668834] bpf_trampoline_link_prog+0x40/0x64
[ 44.669919] bpf_tracing_prog_attach+0x120/0x490
[ 44.671011] link_create+0xe0/0x2b0
[ 44.671869] __sys_bpf+0x484/0xd30
[ 44.672706] __arm64_sys_bpf+0x30/0x40
[ 44.673678] invoke_syscall+0x78/0x100
[ 44.674623] el0_svc_common.constprop.0+0x4c/0xf4
[ 44.675783] do_el0_svc+0x38/0x4c
[ 44.676624] el0_svc+0x34/0x100
[ 44.677429] el0t_64_sync_handler+0x11c/0x150
[ 44.678532] el0t_64_sync+0x190/0x194
[ 44.679439] Code: 2a0203f4 f90013f5 2a0303f5 f9001fe1 (f9400800)
[ 44.680959] ---[ end trace 0000000000000000 ]---
[ 44.682111] Kernel panic - not syncing: Oops: Fatal exception
[ 44.683488] SMP: stopping secondary CPUs
[ 44.684551] Kernel Offset: 0x2721948e0000 from 0xffff800008000000
[ 44.686095] PHYS_OFFSET: 0xfffff4a380000000
[ 44.687144] CPU features: 0x010,00022811,19001080
[ 44.688308] Memory Limit: none
[ 44.689082] ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---
It's caused by a NULL tr->fops passed to ftrace_set_filter_ip(). tr->fops
is initialized to NULL and is assigned to an allocated memory address if
CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is enabled. Since there is no
direct call on arm64 yet, the config can't be enabled.
To fix it, call ftrace_set_filter_ip() only if tr->fops is not NULL.
Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)")
Reported-by: Bruno Goncalves <bgoncalv@redhat.com>
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Tested-by: Bruno Goncalves <bgoncalv@redhat.com>
Acked-by: Song Liu <songliubraving@fb.com>
---
kernel/bpf/trampoline.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index 42e387a12694..0d5a9e0b9a7b 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -255,8 +255,15 @@ static int register_fentry(struct bpf_trampoline *tr, void *new_addr)
return -ENOENT;
if (tr->func.ftrace_managed) {
- ftrace_set_filter_ip(tr->fops, (unsigned long)ip, 0, 0);
- ret = register_ftrace_direct_multi(tr->fops, (long)new_addr);
+ if (tr->fops)
+ ret = ftrace_set_filter_ip(tr->fops, (unsigned long)ip,
+ 0, 0);
+ else
+ ret = -ENOTSUPP;
+
+ if (!ret)
+ ret = register_ftrace_direct_multi(tr->fops,
+ (long)new_addr);
} else {
ret = bpf_arch_text_poke(ip, BPF_MOD_CALL, NULL, new_addr);
}
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next] bpf: Fix NULL pointer dereference when registering bpf trampoline
2022-07-28 11:40 [PATCH bpf-next] bpf: Fix NULL pointer dereference when registering bpf trampoline Xu Kuohai
@ 2022-07-28 12:27 ` Jiri Olsa
2022-07-28 12:56 ` Xu Kuohai
2022-07-29 22:00 ` patchwork-bot+netdevbpf
1 sibling, 1 reply; 6+ messages in thread
From: Jiri Olsa @ 2022-07-28 12:27 UTC (permalink / raw)
To: Xu Kuohai; +Cc: bpf, netdev, Bruno Goncalves, Song Liu
On Thu, Jul 28, 2022 at 07:40:48AM -0400, Xu Kuohai wrote:
> From: Xu Kuohai <xukuohai@huawei.com>
SNIP
>
> It's caused by a NULL tr->fops passed to ftrace_set_filter_ip(). tr->fops
> is initialized to NULL and is assigned to an allocated memory address if
> CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is enabled. Since there is no
> direct call on arm64 yet, the config can't be enabled.
>
> To fix it, call ftrace_set_filter_ip() only if tr->fops is not NULL.
>
> Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)")
> Reported-by: Bruno Goncalves <bgoncalv@redhat.com>
> Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
> Tested-by: Bruno Goncalves <bgoncalv@redhat.com>
> Acked-by: Song Liu <songliubraving@fb.com>
> ---
> kernel/bpf/trampoline.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> index 42e387a12694..0d5a9e0b9a7b 100644
> --- a/kernel/bpf/trampoline.c
> +++ b/kernel/bpf/trampoline.c
> @@ -255,8 +255,15 @@ static int register_fentry(struct bpf_trampoline *tr, void *new_addr)
> return -ENOENT;
>
> if (tr->func.ftrace_managed) {
> - ftrace_set_filter_ip(tr->fops, (unsigned long)ip, 0, 0);
> - ret = register_ftrace_direct_multi(tr->fops, (long)new_addr);
> + if (tr->fops)
> + ret = ftrace_set_filter_ip(tr->fops, (unsigned long)ip,
> + 0, 0);
> + else
> + ret = -ENOTSUPP;
> +
> + if (!ret)
> + ret = register_ftrace_direct_multi(tr->fops,
> + (long)new_addr);
> } else {
> ret = bpf_arch_text_poke(ip, BPF_MOD_CALL, NULL, new_addr);
> }
do we need to do the same also in unregister_fentry and modify_fentry ?
jirka
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next] bpf: Fix NULL pointer dereference when registering bpf trampoline
2022-07-28 12:27 ` Jiri Olsa
@ 2022-07-28 12:56 ` Xu Kuohai
2022-07-28 13:25 ` Jiri Olsa
0 siblings, 1 reply; 6+ messages in thread
From: Xu Kuohai @ 2022-07-28 12:56 UTC (permalink / raw)
To: Jiri Olsa; +Cc: bpf, netdev, Bruno Goncalves, Song Liu
On 7/28/2022 8:27 PM, Jiri Olsa wrote:
> On Thu, Jul 28, 2022 at 07:40:48AM -0400, Xu Kuohai wrote:
>> From: Xu Kuohai <xukuohai@huawei.com>
>
> SNIP
>
>>
>> It's caused by a NULL tr->fops passed to ftrace_set_filter_ip(). tr->fops
>> is initialized to NULL and is assigned to an allocated memory address if
>> CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is enabled. Since there is no
>> direct call on arm64 yet, the config can't be enabled.
>>
>> To fix it, call ftrace_set_filter_ip() only if tr->fops is not NULL.
>>
>> Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)")
>> Reported-by: Bruno Goncalves <bgoncalv@redhat.com>
>> Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
>> Tested-by: Bruno Goncalves <bgoncalv@redhat.com>
>> Acked-by: Song Liu <songliubraving@fb.com>
>> ---
>> kernel/bpf/trampoline.c | 11 +++++++++--
>> 1 file changed, 9 insertions(+), 2 deletions(-)
>>
>> diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
>> index 42e387a12694..0d5a9e0b9a7b 100644
>> --- a/kernel/bpf/trampoline.c
>> +++ b/kernel/bpf/trampoline.c
>> @@ -255,8 +255,15 @@ static int register_fentry(struct bpf_trampoline *tr, void *new_addr)
>> return -ENOENT;
>>
>> if (tr->func.ftrace_managed) {
>> - ftrace_set_filter_ip(tr->fops, (unsigned long)ip, 0, 0);
>> - ret = register_ftrace_direct_multi(tr->fops, (long)new_addr);
>> + if (tr->fops)
>> + ret = ftrace_set_filter_ip(tr->fops, (unsigned long)ip,
>> + 0, 0);
>> + else
>> + ret = -ENOTSUPP;
>> +
>> + if (!ret)
>> + ret = register_ftrace_direct_multi(tr->fops,
>> + (long)new_addr);
>> } else {
>> ret = bpf_arch_text_poke(ip, BPF_MOD_CALL, NULL, new_addr);
>> }
>
> do we need to do the same also in unregister_fentry and modify_fentry ?
>
No need for now, this is the only place where we call ftrace_set_filter_ip().
tr->fops is passed to ftrace_set_filter_ip() and *ftrace_direct_multi()
functions, and when CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is not enabled,
the *ftrace_direct_multi()s do nothing except returning an error code, so
it's safe to pass NULL to them.
> jirka
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next] bpf: Fix NULL pointer dereference when registering bpf trampoline
2022-07-28 12:56 ` Xu Kuohai
@ 2022-07-28 13:25 ` Jiri Olsa
2022-07-29 21:56 ` Andrii Nakryiko
0 siblings, 1 reply; 6+ messages in thread
From: Jiri Olsa @ 2022-07-28 13:25 UTC (permalink / raw)
To: Xu Kuohai; +Cc: Jiri Olsa, bpf, netdev, Bruno Goncalves, Song Liu
On Thu, Jul 28, 2022 at 08:56:27PM +0800, Xu Kuohai wrote:
> On 7/28/2022 8:27 PM, Jiri Olsa wrote:
> > On Thu, Jul 28, 2022 at 07:40:48AM -0400, Xu Kuohai wrote:
> > > From: Xu Kuohai <xukuohai@huawei.com>
> >
> > SNIP
> >
> > >
> > > It's caused by a NULL tr->fops passed to ftrace_set_filter_ip(). tr->fops
> > > is initialized to NULL and is assigned to an allocated memory address if
> > > CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is enabled. Since there is no
> > > direct call on arm64 yet, the config can't be enabled.
> > >
> > > To fix it, call ftrace_set_filter_ip() only if tr->fops is not NULL.
> > >
> > > Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)")
> > > Reported-by: Bruno Goncalves <bgoncalv@redhat.com>
> > > Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
> > > Tested-by: Bruno Goncalves <bgoncalv@redhat.com>
> > > Acked-by: Song Liu <songliubraving@fb.com>
> > > ---
> > > kernel/bpf/trampoline.c | 11 +++++++++--
> > > 1 file changed, 9 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> > > index 42e387a12694..0d5a9e0b9a7b 100644
> > > --- a/kernel/bpf/trampoline.c
> > > +++ b/kernel/bpf/trampoline.c
> > > @@ -255,8 +255,15 @@ static int register_fentry(struct bpf_trampoline *tr, void *new_addr)
> > > return -ENOENT;
> > > if (tr->func.ftrace_managed) {
> > > - ftrace_set_filter_ip(tr->fops, (unsigned long)ip, 0, 0);
> > > - ret = register_ftrace_direct_multi(tr->fops, (long)new_addr);
> > > + if (tr->fops)
> > > + ret = ftrace_set_filter_ip(tr->fops, (unsigned long)ip,
> > > + 0, 0);
> > > + else
> > > + ret = -ENOTSUPP;
> > > +
> > > + if (!ret)
> > > + ret = register_ftrace_direct_multi(tr->fops,
> > > + (long)new_addr);
> > > } else {
> > > ret = bpf_arch_text_poke(ip, BPF_MOD_CALL, NULL, new_addr);
> > > }
> >
> > do we need to do the same also in unregister_fentry and modify_fentry ?
> >
>
> No need for now, this is the only place where we call ftrace_set_filter_ip().
>
> tr->fops is passed to ftrace_set_filter_ip() and *ftrace_direct_multi()
> functions, and when CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is not enabled,
> the *ftrace_direct_multi()s do nothing except returning an error code, so
> it's safe to pass NULL to them.
ok, makes sense
Acked-by: Jiri Olsa <jolsa@kernel.org>
jirka
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next] bpf: Fix NULL pointer dereference when registering bpf trampoline
2022-07-28 13:25 ` Jiri Olsa
@ 2022-07-29 21:56 ` Andrii Nakryiko
0 siblings, 0 replies; 6+ messages in thread
From: Andrii Nakryiko @ 2022-07-29 21:56 UTC (permalink / raw)
To: Jiri Olsa; +Cc: Xu Kuohai, bpf, Networking, Bruno Goncalves, Song Liu
On Thu, Jul 28, 2022 at 6:31 AM Jiri Olsa <olsajiri@gmail.com> wrote:
>
> On Thu, Jul 28, 2022 at 08:56:27PM +0800, Xu Kuohai wrote:
> > On 7/28/2022 8:27 PM, Jiri Olsa wrote:
> > > On Thu, Jul 28, 2022 at 07:40:48AM -0400, Xu Kuohai wrote:
> > > > From: Xu Kuohai <xukuohai@huawei.com>
> > >
> > > SNIP
> > >
> > > >
> > > > It's caused by a NULL tr->fops passed to ftrace_set_filter_ip(). tr->fops
> > > > is initialized to NULL and is assigned to an allocated memory address if
> > > > CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is enabled. Since there is no
> > > > direct call on arm64 yet, the config can't be enabled.
> > > >
> > > > To fix it, call ftrace_set_filter_ip() only if tr->fops is not NULL.
> > > >
> > > > Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)")
> > > > Reported-by: Bruno Goncalves <bgoncalv@redhat.com>
> > > > Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
> > > > Tested-by: Bruno Goncalves <bgoncalv@redhat.com>
> > > > Acked-by: Song Liu <songliubraving@fb.com>
> > > > ---
> > > > kernel/bpf/trampoline.c | 11 +++++++++--
> > > > 1 file changed, 9 insertions(+), 2 deletions(-)
> > > >
> > > > diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> > > > index 42e387a12694..0d5a9e0b9a7b 100644
> > > > --- a/kernel/bpf/trampoline.c
> > > > +++ b/kernel/bpf/trampoline.c
> > > > @@ -255,8 +255,15 @@ static int register_fentry(struct bpf_trampoline *tr, void *new_addr)
> > > > return -ENOENT;
> > > > if (tr->func.ftrace_managed) {
> > > > - ftrace_set_filter_ip(tr->fops, (unsigned long)ip, 0, 0);
> > > > - ret = register_ftrace_direct_multi(tr->fops, (long)new_addr);
> > > > + if (tr->fops)
> > > > + ret = ftrace_set_filter_ip(tr->fops, (unsigned long)ip,
> > > > + 0, 0);
> > > > + else
> > > > + ret = -ENOTSUPP;
> > > > +
> > > > + if (!ret)
> > > > + ret = register_ftrace_direct_multi(tr->fops,
> > > > + (long)new_addr);
> > > > } else {
> > > > ret = bpf_arch_text_poke(ip, BPF_MOD_CALL, NULL, new_addr);
> > > > }
> > >
> > > do we need to do the same also in unregister_fentry and modify_fentry ?
> > >
> >
> > No need for now, this is the only place where we call ftrace_set_filter_ip().
> >
> > tr->fops is passed to ftrace_set_filter_ip() and *ftrace_direct_multi()
> > functions, and when CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is not enabled,
> > the *ftrace_direct_multi()s do nothing except returning an error code, so
> > it's safe to pass NULL to them.
>
> ok, makes sense
>
> Acked-by: Jiri Olsa <jolsa@kernel.org>
>
I've simplified this to
diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index 7ec7e23559ad..c122d8b3ddc9 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -248,8 +248,11 @@ static int register_fentry(struct bpf_trampoline
*tr, void *new_addr)
int ret;
faddr = ftrace_location((unsigned long)ip);
- if (faddr)
+ if (faddr) {
+ if (!tr->fops)
+ return -ENOTSUPP;
tr->func.ftrace_managed = true;
+ }
and pushed to bpf-next. Thanks.
> jirka
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next] bpf: Fix NULL pointer dereference when registering bpf trampoline
2022-07-28 11:40 [PATCH bpf-next] bpf: Fix NULL pointer dereference when registering bpf trampoline Xu Kuohai
2022-07-28 12:27 ` Jiri Olsa
@ 2022-07-29 22:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 6+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-07-29 22:00 UTC (permalink / raw)
To: Xu Kuohai; +Cc: bpf, netdev, bgoncalv, song
Hello:
This patch was applied to bpf/bpf-next.git (master)
by Andrii Nakryiko <andrii@kernel.org>:
On Thu, 28 Jul 2022 07:40:48 -0400 you wrote:
> From: Xu Kuohai <xukuohai@huawei.com>
>
> A panic was reported on arm64:
>
> [ 44.517109] audit: type=1334 audit(1658859870.268:59): prog-id=19 op=LOAD
> [ 44.622031] Unable to handle kernel NULL pointer dereference at
> virtual address 0000000000000010
> [ 44.624321] Mem abort info:
> [ 44.625049] ESR = 0x0000000096000004
> [ 44.625935] EC = 0x25: DABT (current EL), IL = 32 bits
> [ 44.627182] SET = 0, FnV = 0
> [ 44.627930] EA = 0, S1PTW = 0
> [ 44.628684] FSC = 0x04: level 0 translation fault
> [ 44.629788] Data abort info:
> [ 44.630474] ISV = 0, ISS = 0x00000004
> [ 44.631362] CM = 0, WnR = 0
> [ 44.632041] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000100ab5000
> [ 44.633494] [0000000000000010] pgd=0000000000000000, p4d=0000000000000000
> [ 44.635202] Internal error: Oops: 96000004 [#1] SMP
> [ 44.636452] Modules linked in: xfs crct10dif_ce ghash_ce virtio_blk
> virtio_console virtio_mmio qemu_fw_cfg
> [ 44.638713] CPU: 2 PID: 1 Comm: systemd Not tainted 5.19.0-rc7 #1
> [ 44.640164] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
> [ 44.641799] pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [ 44.643404] pc : ftrace_set_filter_ip+0x24/0xa0
> [ 44.644659] lr : bpf_trampoline_update.constprop.0+0x428/0x4a0
> [ 44.646118] sp : ffff80000803b9f0
> [ 44.646950] x29: ffff80000803b9f0 x28: ffff0b5d80364400 x27: ffff80000803bb48
> [ 44.648721] x26: ffff8000085ad000 x25: ffff0b5d809d2400 x24: 0000000000000000
> [ 44.650493] x23: 00000000ffffffed x22: ffff0b5dd7ea0900 x21: 0000000000000000
> [ 44.652279] x20: 0000000000000000 x19: 0000000000000000 x18: ffffffffffffffff
> [ 44.654067] x17: 0000000000000000 x16: 0000000000000000 x15: ffffffffffffffff
> [ 44.655787] x14: ffff0b5d809d2498 x13: ffff0b5d809d2432 x12: 0000000005f5e100
> [ 44.657535] x11: abcc77118461cefd x10: 000000000000005f x9 : ffffa7219cb5b190
> [ 44.659254] x8 : ffffa7219c8e0000 x7 : 0000000000000000 x6 : ffffa7219db075e0
> [ 44.661066] x5 : ffffa7219d3130e0 x4 : ffffa7219cab9da0 x3 : 0000000000000000
> [ 44.662837] x2 : 0000000000000000 x1 : ffffa7219cb7a5c0 x0 : 0000000000000000
> [ 44.664675] Call trace:
> [ 44.665274] ftrace_set_filter_ip+0x24/0xa0
> [ 44.666327] bpf_trampoline_update.constprop.0+0x428/0x4a0
> [ 44.667696] __bpf_trampoline_link_prog+0xcc/0x1c0
> [ 44.668834] bpf_trampoline_link_prog+0x40/0x64
> [ 44.669919] bpf_tracing_prog_attach+0x120/0x490
> [ 44.671011] link_create+0xe0/0x2b0
> [ 44.671869] __sys_bpf+0x484/0xd30
> [ 44.672706] __arm64_sys_bpf+0x30/0x40
> [ 44.673678] invoke_syscall+0x78/0x100
> [ 44.674623] el0_svc_common.constprop.0+0x4c/0xf4
> [ 44.675783] do_el0_svc+0x38/0x4c
> [ 44.676624] el0_svc+0x34/0x100
> [ 44.677429] el0t_64_sync_handler+0x11c/0x150
> [ 44.678532] el0t_64_sync+0x190/0x194
> [ 44.679439] Code: 2a0203f4 f90013f5 2a0303f5 f9001fe1 (f9400800)
> [ 44.680959] ---[ end trace 0000000000000000 ]---
> [ 44.682111] Kernel panic - not syncing: Oops: Fatal exception
> [ 44.683488] SMP: stopping secondary CPUs
> [ 44.684551] Kernel Offset: 0x2721948e0000 from 0xffff800008000000
> [ 44.686095] PHYS_OFFSET: 0xfffff4a380000000
> [ 44.687144] CPU features: 0x010,00022811,19001080
> [ 44.688308] Memory Limit: none
> [ 44.689082] ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---
>
> [...]
Here is the summary with links:
- [bpf-next] bpf: Fix NULL pointer dereference when registering bpf trampoline
https://git.kernel.org/bpf/bpf-next/c/3b317abc7159
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-07-29 22:00 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-07-28 11:40 [PATCH bpf-next] bpf: Fix NULL pointer dereference when registering bpf trampoline Xu Kuohai
2022-07-28 12:27 ` Jiri Olsa
2022-07-28 12:56 ` Xu Kuohai
2022-07-28 13:25 ` Jiri Olsa
2022-07-29 21:56 ` Andrii Nakryiko
2022-07-29 22:00 ` patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.