Daniel Borkmann 65073a6733 bpf: fix null pointer deref in bpf_prog_test_run_xdp ... syzkaller was able to generate the following XDP program ... (18) r0 = 0x0 (61) r5 = *(u32 *)(r1 +12) (04) (u32) r0 += (u32) 0 (95) exit ... and trigger a NULL pointer dereference in ___bpf_prog_run() via bpf_prog_test_run_xdp() where this was attempted to run. Reason is that recent xdp_rxq_info addition to XDP programs updated all drivers, but not bpf_prog_test_run_xdp(), where xdp_buff is set up. Thus when context rewriter does the deref on the netdev it's NULL at runtime. Fix it by using xdp_rxq from loopback dev. __netif_get_rx_queue() helper can also be reused in various other locations later on. Fixes: 02dd3291b2 ("bpf: finally expose xdp_rxq_info to XDP bpf-programs") Reported-by: syzbot+1eb094057b338eb1fc00@syzkaller.appspotmail.com Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Cc: Jesper Dangaard Brouer <brouer@redhat.com> Acked-by: Jesper Dangaard Brouer <brouer@redhat.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org>		2018-02-01 07:43:56 -08:00
..
fault-injection	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
ktest	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nvdimm	libnvdimm for 4.15	2017-11-17 09:51:57 -08:00
radix-tree	mm, truncate: do not check mapping for every page being truncated	2017-11-15 18:21:06 -08:00
scatterlist	tools/testing/scatterlist: Test new __sg_alloc_table_from_pages	2017-09-07 10:54:40 +01:00
selftests	bpf: fix null pointer deref in bpf_prog_test_run_xdp	2018-02-01 07:43:56 -08:00
vsock	VSOCK: add tools/testing/vsock/vsock_diag_test	2017-10-05 18:44:17 -07:00