Re: [PATCH bpf v2] bpf: Fix NULL pointer dereference in __bpf_sk_storage_map_seq_show

[luoxuanqiang <xuanqiang.luo@linux.dev>]

在 2026/9/11 22:03, Cen Zhang (Microsoft Security FORGE Labs) 写道:

> Iterating a sk_storage map is a two-stage operation:
> bpf_sk_storage_map_seq_find_next() returns a selem, then
> __bpf_sk_storage_map_seq_show() uses it. The latter re-reads
> selem->local_storage via rcu_dereference() without checking for NULL.
> A concurrent socket close can unlink the selem and clear that pointer
> between the two stages, causing a NULL dereference of sk_storage->owner.
>
> Oops: general protection fault, probably for non-canonical
>     address 0xdffffc0000000011
>    net/core/bpf_sk_storage.c:809 __bpf_sk_storage_map_seq_show()
>    bpf_seq_read+0x366/0x1120
>    vfs_read+0x174/0xa50
>    ksys_read+0xfc/0x1d0
>
> Return SEQ_SKIP if the re-read yields NULL. This prevents the dereference
> and tells bpf_seq_read() that the stale element was skipped, so it does
> not consume an iterator sequence number without running the BPF program.
>
> Fixes: 0be08389c7f2 ("bpf: Switch to bpf_selem_unlink_nofail in bpf_local_storage_{map_free, destroy}")
> Reported-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
> Closes: https://lore.kernel.org/all/20260827051859.45511-1-blbllhy@gmail.com/
> Suggested-by: Amery Hung <ameryhung@gmail.com>
> Suggested-by: Xuanqiang Luo <xuanqiang.luo@linux.dev>
> Link: https://lore.kernel.org/all/CAMB2axNFOC9G2RwOCnsWDth83REMWnmPE8gxMwbLYoGusw9miA@mail.gmail.com/
> Link: https://lore.kernel.org/all/c3f2a61d-d5bc-454c-987d-717b5f8c8809@linux.dev/
> Cc: AutonomousCodeSecurity@microsoft.com
> Signed-off-by: Cen Zhang (Microsoft Security FORGE Labs) <cenzhang@linux.microsoft.com>
> Assisted-by: Copilot (Grok 4.6)

Reviewed-by: Xuanqiang Luo<luoxuanqiang@kylinos.cn>

Thanks,
Xuanqiang