【OLK-6.6】bpf freplace类型程序调用kfunc产生空指针异常

**【OLK-6.6】bpf freplace类型程序调用kfunc产生空指针异常**

**一、缺陷信息**
Unable to handle kernel paging request at virtual address dfff800000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfff800000000000] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] SMP
Modules linked in:
CPU: 1 PID: 11347 Comm: syz-executor.3 Not tainted 6.6.0+ #3
Hardware name: linux,dummy-virt (DT)
pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : resolve_prog_type include/linux/bpf_verifier.h:804 [inline]
pc : may_access_direct_pkt_data+0x234/0x298 kernel/bpf/verifier.c:5467
lr : resolve_prog_type include/linux/bpf_verifier.h:804 [inline]
lr : may_access_direct_pkt_data+0x1e4/0x298 kernel/bpf/verifier.c:5467
sp : ffff800083657640
x29: ffff800083657640 x28: 0000000000000000 x27: ffffd15c1aa5cae8
x26: ffff000014ce6200 x25: 0000000000000000 x24: 1ffff000106caee2
x23: ffff80008ec89000 x22: 0000000000000000 x21: 0000000000000002
x20: ffff00000e540000 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: ffffd15c12344b08 x15: 0000000000000000
x14: 0000000000000100 x13: 0000000000004e50 x12: ffff7000106caef1
x11: 1ffff000106caef0 x10: ffff7000106caef0 x9 : ffffd15c124f567c
x8 : 1ffff000106cae6a x7 : 0000000041b58ab3 x6 : ffff7000106cae6a
x5 : ffff0000cc33c080 x4 : 0000000000000002 x3 : 0000000000000000
x2 : dfff800000000000 x1 : 0000000000000007 x0 : 0000000000000004
Call trace:
 resolve_prog_type include/linux/bpf_verifier.h:804 [inline]
 may_access_direct_pkt_data+0x234/0x298 kernel/bpf/verifier.c:5467
 specialize_kfunc kernel/bpf/verifier.c:18767 [inline]
 add_kfunc_call+0x95c/0xc28 kernel/bpf/verifier.c:2933
 add_subprog_and_kfunc+0x254/0x6d0 kernel/bpf/verifier.c:3038
 bpf_check+0x764/0x36f8 kernel/bpf/verifier.c:20317
 bpf_prog_load+0xc78/0x1828 kernel/bpf/syscall.c:2747
 __sys_bpf+0x72c/0xf90 kernel/bpf/syscall.c:5431
 __do_sys_bpf kernel/bpf/syscall.c:5535 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5533 [inline]
 __arm64_sys_bpf+0x7c/0xc0 kernel/bpf/syscall.c:5533
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall+0x8c/0x2e0 arch/arm64/kernel/syscall.c:51
 el0_svc_common.constprop.0+0x200/0x2a8 arch/arm64/kernel/syscall.c:136
 do_el0_svc+0x4c/0x70 arch/arm64/kernel/syscall.c:178
 el0_svc+0x4c/0x1f8 arch/arm64/kernel/entry-common.c:705
 el0t_64_sync_handler+0x100/0x130 arch/arm64/kernel/entry-common.c:723
 el0t_64_sync+0x188/0x190 arch/arm64/kernel/entry.S:599
Code: 91001260 92400801 d343fc03 11000c21 (38e26862)

**内核信息：**

6.6.0-28.0.0

**缺陷归属组件：**

bpf

**缺陷归属的版本：**

6.6.0-28.0.0

**缺陷简述：**

使用bpf freplace程序调用kfunc，如果freplace的对象程序不传入，则将触发resolve_prog_type空指针解引用，产生问题。

**【环境信息】**
任意架构的qemu虚拟机或物理机均可复现。

**【问题复现步骤】**
1. 定义freplace程序
2. 在程序内部调用bpf_dynptr_from_skb()
3. load程序，不传入attach_prog_fd

**【实际结果】**
内核日志打印NULL pointer dereference

**【其他相关附件信息】**
NA

**缺陷详情参考链接：**
NA

**缺陷分析指导链接：**
https://lore.kernel.org/all/20240711145819.254178-2-wutengda@huaweicloud.com/

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识