[PATCH net] bpf: Add missing map_get_next_key method to bloom filter map

[PATCH net] bpf: Add missing map_get_next_key method to bloom filter map

[Eric Dumazet]

From: Eric Dumazet <edumazet@google.com>

It appears map_get_next_key() method is mandatory,
as syzbot is able to trigger a NULL deref in map_get_next_key().

Fixes: 9330986c0300 ("bpf: Add bloom filter map implementation")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Yonghong Song <yhs@fb.com>
---
 kernel/bpf/bloom_filter.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/bpf/bloom_filter.c b/kernel/bpf/bloom_filter.c
index 277a05e9c9849324a277d77eeec12963cc7519b7..34f48058515cfd3f8ea6816ccad1f4a26eba0ebf 100644
--- a/kernel/bpf/bloom_filter.c
+++ b/kernel/bpf/bloom_filter.c
@@ -82,6 +82,12 @@ static int bloom_map_delete_elem(struct bpf_map *map, void *value)
 	return -EOPNOTSUPP;
 }
 
+static int bloom_get_next_key(struct bpf_map *map, void *key,
+			      void *next_key)
+{
+	return -ENOTSUPP;
+}
+
 static struct bpf_map *bloom_map_alloc(union bpf_attr *attr)
 {
 	u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits;
@@ -201,4 +207,5 @@ const struct bpf_map_ops bloom_filter_map_ops = {
 	.map_check_btf = bloom_map_check_btf,
 	.map_btf_name = "bpf_bloom_filter",
 	.map_btf_id = &bpf_bloom_map_btf_id,
+	.map_get_next_key = bloom_get_next_key,
 };
-- 
2.34.1.448.ga2b2bfdf31-goog

Re: [PATCH net] bpf: Add missing map_get_next_key method to bloom filter map

[Daniel Borkmann]

Hi Eric, [ +Joanne, ]

On 1/4/22 10:01 AM, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
> 
> It appears map_get_next_key() method is mandatory,
> as syzbot is able to trigger a NULL deref in map_get_next_key().
> 
> Fixes: 9330986c0300 ("bpf: Add bloom filter map implementation")
> Reported-by: syzbot <syzkaller@googlegroups.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Alexei Starovoitov <ast@kernel.org>
> Cc: Yonghong Song <yhs@fb.com>

Thanks for your patch, this has recently been fixed:

   https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=3ccdcee28415c4226de05438b4d89eb5514edf73

I'm not quite sure why it was applied to bpf-next instead of bpf (maybe assumption was
that there would be no rc8 anymore), but I'd expect it to land in Linus' tree once merge
window opens up on 9th Jan. In that case stable team would have to pick it up for 5.16.

Thanks,
Daniel

Re: [PATCH net] bpf: Add missing map_get_next_key method to bloom filter map

[Eric Dumazet]

On Tue, Jan 4, 2022 at 1:21 AM Daniel Borkmann <daniel@iogearbox.net> wrote:
>
> Hi Eric, [ +Joanne, ]
>
> On 1/4/22 10:01 AM, Eric Dumazet wrote:
> > From: Eric Dumazet <edumazet@google.com>
> >
> > It appears map_get_next_key() method is mandatory,
> > as syzbot is able to trigger a NULL deref in map_get_next_key().
> >
> > Fixes: 9330986c0300 ("bpf: Add bloom filter map implementation")
> > Reported-by: syzbot <syzkaller@googlegroups.com>
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > Cc: Alexei Starovoitov <ast@kernel.org>
> > Cc: Yonghong Song <yhs@fb.com>
>
> Thanks for your patch, this has recently been fixed:
>
>    https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=3ccdcee28415c4226de05438b4d89eb5514edf73
>
> I'm not quite sure why it was applied to bpf-next instead of bpf (maybe assumption was
> that there would be no rc8 anymore), but I'd expect it to land in Linus' tree once merge
> window opens up on 9th Jan. In that case stable team would have to pick it up for 5.16.
>

Ah, this is why I could not find the fix in bpf or net tree, thanks.


> Thanks,
> Daniel