Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

bpf: Fix an issue due to uninitialized bpf_iter_task

Failure to initialize it->pos, coupled with the presence of an invalid
value in the flags variable, can lead to it->pos referencing an invalid
task, potentially resulting in a kernel panic. To mitigate this risk, it's
crucial to ensure proper initialization of it->pos to NULL.

Fixes: ac8148d957f5 ("bpf: bpf_iter_task_next: use next_task(kit->task) rather than next_task(kit->pos)")
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Link: https://lore.kernel.org/bpf/20240217114152.1623-2-laoar.shao@gmail.com

authored by

Yafang Shao and committed by
Daniel Borkmann
5f2ae606 3f00e4a9

+2
+2
kernel/bpf/task_iter.c
··· 978 978 BUILD_BUG_ON(__alignof__(struct bpf_iter_task_kern) != 979 979 __alignof__(struct bpf_iter_task)); 980 980 981 + kit->pos = NULL; 982 + 981 983 switch (flags) { 982 984 case BPF_TASK_ITER_ALL_THREADS: 983 985 case BPF_TASK_ITER_ALL_PROCS: