Commit 09a3dac7 authored Nov 11, 2020 by Martin KaFai Lau Committed by Alexei Starovoitov Nov 11, 2020

bpf: Fix NULL dereference in bpf_task_storage



In bpf_pid_task_storage_update_elem(), it missed to
test the !task_storage_ptr(task) which then could trigger a NULL
pointer exception in bpf_local_storage_update().

Fixes: 4cf1bc1f ("bpf: Implement task local storage")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Tested-by: Roman Gushchin <guro@fb.com>
Acked-by: KP Singh <kpsingh@google.com>
Link: https://lore.kernel.org/bpf/20201112001919.2028357-1-kafai@fb.com

parent 8378788c

kernel/bpf/bpf_task_storage.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -150,7 +150,7 @@ static int bpf_pid_task_storage_update_elem(struct bpf_map map, void key,
		*/
		WARN_ON_ONCE(!rcu_read_lock_held());
		task = pid_task(pid, PIDTYPE_PID);
		if (!task) {
		if (!task \|\| !task_storage_ptr(task)) {
		err = -ENOENT;
		goto out;
		}

Admin message