2014-12-10 23:51:35

by Alexei Starovoitov

[permalink] [raw]
Subject: Re: [net: sock] BUG: unable to handle kernel NULL pointer dereference at 0000000000000007

On Wed, Dec 10, 2014 at 3:29 PM, Fengguang Wu <[email protected]> wrote:
> Greetings,
>
> 0day kernel testing robot got the below dmesg and the first bad commit is
>
> net: sock: allow eBPF programs to be attached to sockets

> [init] Kernel was tainted on startup. Will ignore flags that are already set.
> [init] Started watchdog process, PID is 9354
> [main] Main thread is alive.
> [ 21.233581] BUG: unable to handle kernel NULL pointer dereference at 0000000000000007
> [ 21.234709] IP: [<ffffffff8156ebda>] sk_attach_bpf+0x39/0xc2

thanks for the report! syscall fuzzer is great.
I missed an extra check. Working on a fix.

2014-12-11 01:48:25

by Dave Jones

[permalink] [raw]
Subject: Re: [net: sock] BUG: unable to handle kernel NULL pointer dereference at 0000000000000007

On Wed, Dec 10, 2014 at 03:51:33PM -0800, Alexei Starovoitov wrote:
> On Wed, Dec 10, 2014 at 3:29 PM, Fengguang Wu <[email protected]> wrote:
> > Greetings,
> >
> > 0day kernel testing robot got the below dmesg and the first bad commit is
> >
> > net: sock: allow eBPF programs to be attached to sockets
>
> > [init] Kernel was tainted on startup. Will ignore flags that are already set.
> > [init] Started watchdog process, PID is 9354
> > [main] Main thread is alive.
> > [ 21.233581] BUG: unable to handle kernel NULL pointer dereference at 0000000000000007
> > [ 21.234709] IP: [<ffffffff8156ebda>] sk_attach_bpf+0x39/0xc2
>
> thanks for the report! syscall fuzzer is great.
> I missed an extra check. Working on a fix.

This might be the first time I've seen it trip up the bpf code iirc.
Daniel wrote some pretty nifty bpf generator code in trinity,
(net/bpf.c) that you might want to see if you can think of enhancing.

Though it might be the case that we're not even needing to do anything
that complicated to hit this particular bug..

Dave