bpf: kernel NULL pointer dereference in map_get_next_key

[Dmitry Vyukov]

Hello,

The following program causes kernel NULL pointer dereference in
map_get_next_key:

BUG: unable to handle kernel NULL pointer dereference at (null)
IP: (null)
PGD 64a8f067
PUD 65c78067
PMD 0
Oops: 0010 [#1] SMP KASAN
Modules linked in:
CPU: 3 PID: 2953 Comm: a.out Not tainted 4.10.0+ #297
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88006b6d4240 task.stack: ffff880069670000
RIP: 0010: (null)
RSP: 0018:ffff880069677610 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff880066804bc8 RCX: 1ffff1000d2ceeb6
RDX: ffff88006c971240 RSI: ffff88006c971200 RDI: ffff880066804bc0
RBP: ffff880069677f48 R08: 000000004d6b4af0 R09: 0000000000000000
R10: dffffc0000000000 R11: 643f6e6862766c3c R12: ffffffff846de800
R13: ffff88006c971200 R14: ffff880066804bc0 R15: ffff880069677ec0
FS: 0000000002285880(0000) GS:ffff88006cf80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000064fad000 CR4: 00000000001406e0
Call Trace:
entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x434ae9
RSP: 002b:00007ffdb4a47258 EFLAGS: 00000203 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000401840 RCX: 0000000000434ae9
RDX: 0000000000000018 RSI: 00000000200030ad RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000203 R12: 00000000004002b0
R13: 0000000000401840 R14: 00000000004018d0 R15: 0000000000000000
Code: Bad RIP value.
RIP: (null) RSP: ffff880069677610
CR2: 0000000000000000
---[ end trace 33dfce8e7f877b5e ]---


// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <sys/syscall.h>
#include <stdint.h>

int main()
{
int fd;

syscall(__NR_mmap, 0x20000000ul, 0x5000ul, 0x3ul, 0x32ul, -1, 0);
(*(uint32_t*)0x20001fec = (uint32_t)0xb);
(*(uint32_t*)0x20001ff0 = (uint32_t)0x6);
(*(uint32_t*)0x20001ff4 = (uint32_t)0x5);
(*(uint32_t*)0x20001ff8 = (uint32_t)0x1);
(*(uint32_t*)0x20001ffc = (uint32_t)0x1);
fd = syscall(__NR_bpf, 0x0ul, 0x20001fecul, 0x14ul);
(*(uint32_t*)0x200030ad = fd);
(*(uint64_t*)0x200030b5 = (uint64_t)0x20004000);
(*(uint64_t*)0x200030bd = (uint64_t)0x20001000);
syscall(__NR_bpf, 0x4ul, 0x200030adul, 0x18ul);
return 0;
}

On commit 0710f3ff91ecc4a715db6e4d0690472b13c4dac6