bpf: kernel NULL pointer dereference in map_get_next_key

[Dmitry Vyukov]

Hello,

The following program causes kernel NULL pointer dereference in
map_get_next_key:

BUG: unable to handle kernel NULL pointer dereference at           (null)
IP:           (null)
PGD 64a8f067
PUD 65c78067
PMD 0
Oops: 0010 [#1] SMP KASAN
Modules linked in:
CPU: 3 PID: 2953 Comm: a.out Not tainted 4.10.0+ #297
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88006b6d4240 task.stack: ffff880069670000
RIP: 0010:          (null)
RSP: 0018:ffff880069677610 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff880066804bc8 RCX: 1ffff1000d2ceeb6
RDX: ffff88006c971240 RSI: ffff88006c971200 RDI: ffff880066804bc0
RBP: ffff880069677f48 R08: 000000004d6b4af0 R09: 0000000000000000
R10: dffffc0000000000 R11: 643f6e6862766c3c R12: ffffffff846de800
R13: ffff88006c971200 R14: ffff880066804bc0 R15: ffff880069677ec0
FS:  0000000002285880(0000) GS:ffff88006cf80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000064fad000 CR4: 00000000001406e0
Call Trace:
 entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x434ae9
RSP: 002b:00007ffdb4a47258 EFLAGS: 00000203 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000401840 RCX: 0000000000434ae9
RDX: 0000000000000018 RSI: 00000000200030ad RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000203 R12: 00000000004002b0
R13: 0000000000401840 R14: 00000000004018d0 R15: 0000000000000000
Code:  Bad RIP value.
RIP:           (null) RSP: ffff880069677610
CR2: 0000000000000000
---[ end trace 33dfce8e7f877b5e ]---


// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <sys/syscall.h>
#include <stdint.h>

int main()
{
  int fd;

  syscall(__NR_mmap, 0x20000000ul, 0x5000ul, 0x3ul, 0x32ul, -1, 0);
  (*(uint32_t*)0x20001fec = (uint32_t)0xb);
  (*(uint32_t*)0x20001ff0 = (uint32_t)0x6);
  (*(uint32_t*)0x20001ff4 = (uint32_t)0x5);
  (*(uint32_t*)0x20001ff8 = (uint32_t)0x1);
  (*(uint32_t*)0x20001ffc = (uint32_t)0x1);
  fd = syscall(__NR_bpf, 0x0ul, 0x20001fecul, 0x14ul);
  (*(uint32_t*)0x200030ad = fd);
  (*(uint64_t*)0x200030b5 = (uint64_t)0x20004000);
  (*(uint64_t*)0x200030bd = (uint64_t)0x20001000);
  syscall(__NR_bpf, 0x4ul, 0x200030adul, 0x18ul);
  return 0;
}

On commit 0710f3ff91ecc4a715db6e4d0690472b13c4dac6