mirror of
https://github.com/torvalds/linux.git
synced 2026-03-08 03:24:45 +01:00
94e948b7e6
As reported in [0], anonymous memory mappings are not backed by a struct file instance. Consequently, the struct file pointer passed to the security_mmap_file() LSM hook is NULL in such cases. The BPF verifier is currently unaware of this, allowing BPF LSM programs to dereference this struct file pointer without needing to perform an explicit NULL check. This leads to potential NULL pointer dereference and a kernel crash. Add a strong override for bpf_lsm_mmap_file() which annotates the struct file pointer parameter with the __nullable suffix. This explicitly informs the BPF verifier that this pointer (PTR_MAYBE_NULL) can be NULL, forcing BPF LSM programs to perform a check on it before dereferencing it. [0] https://lore.kernel.org/bpf/5e460d3c.4c3e9.19adde547d8.Coremail.kaiyanm@hust.edu.cn/ Reported-by: Kaiyan Mei <M202472210@hust.edu.cn> Reported-by: Yinhao Hu <dddddd@hust.edu.cn> Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn> Closes: https://lore.kernel.org/bpf/5e460d3c.4c3e9.19adde547d8.Coremail.kaiyanm@hust.edu.cn/ Signed-off-by: Matt Bobrowski <mattbobrowski@google.com> Acked-by: Song Liu <song@kernel.org> Link: https://lore.kernel.org/r/20251216133000.3690723-1-mattbobrowski@google.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
19 lines
523 B
C
19 lines
523 B
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Copyright 2025 Google LLC.
|
|
*/
|
|
|
|
#include <linux/fs.h>
|
|
#include <linux/bpf_lsm.h>
|
|
|
|
/*
|
|
* Strong definition of the mmap_file() BPF LSM hook. The __nullable suffix on
|
|
* the struct file pointer parameter name marks it as PTR_MAYBE_NULL. This
|
|
* explicitly enforces that BPF LSM programs check for NULL before attempting to
|
|
* dereference it.
|
|
*/
|
|
int bpf_lsm_mmap_file(struct file *file__nullable, unsigned long reqprot,
|
|
unsigned long prot, unsigned long flags)
|
|
{
|
|
return 0;
|
|
}
|