[syzbot] [bpf?] [net?] BUG: unable to handle kernel NULL pointer dereference in dev_map_generic_redirect

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    026e680b0a08 Merge tag 'pwm/for-6.9-rc3-fixes' of git://gi..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17dc5d5e180000
kernel config:  https://syzkaller.appspot.com/x/.config?x=10acd270ef193b93
dashboard link: https://syzkaller.appspot.com/bug?extid=aa38edb98c8bd20d2915
compiler:       arm-linux-gnueabi-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/8ead8862021c/non_bootable_disk-026e680b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/085338135a57/vmlinux-026e680b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4b6e5889af37/zImage-026e680b.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aa38edb98c8bd20d2915@xxxxxxxxxxxxxxxxxxxxxxxxx

8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 0000008d when read
[0000008d] *pgd=85442003, *pmd=fc491003
Internal error: Oops: 207 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 1 PID: 13298 Comm: syz-executor.0 Not tainted 6.9.0-rc2-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at xdp_ok_fwd_dev include/linux/filter.h:1009 [inline]
PC is at dev_map_generic_redirect+0x24/0x23c kernel/bpf/devmap.c:681
LR is at xdp_do_generic_redirect_map net/core/filter.c:4463 [inline]
LR is at xdp_do_generic_redirect+0x1d8/0x4d4 net/core/filter.c:4520
pc : [<803f2e70>]    lr : [<813e318c>]    psr: 60000013
sp : dfa41d00  ip : dfa41d58  fp : dfa41d54
r10: 0000fdef  r9 : 83641800  r8 : dfa43000
r7 : 00000001  r6 : 841bb400  r5 : 855c8a80  r4 : 824b3560
r3 : 00000000  r2 : dfa43000  r1 : 855c8a80  r0 : 841bb400
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 85104f00  DAC: 00000000
Register r0 information: slab kmalloc-cg-64 start 841bb400 pointer offset 0 size 64
Register r1 information: slab skbuff_head_cache start 855c8a80 pointer offset 0 size 192
Register r2 information: 1-page vmalloc region starting at 0xdfa43000 allocated at bpf_prog_alloc_no_stats+0x38/0x1cc kernel/bpf/core.c:103
Register r3 information: NULL pointer
Register r4 information: non-slab/vmalloc memory
Register r5 information: slab skbuff_head_cache start 855c8a80 pointer offset 0 size 192
Register r6 information: slab kmalloc-cg-64 start 841bb400 pointer offset 0 size 64
Register r7 information: non-paged memory
Register r8 information: 1-page vmalloc region starting at 0xdfa43000 allocated at bpf_prog_alloc_no_stats+0x38/0x1cc kernel/bpf/core.c:103
Register r9 information: slab task_struct start 83641800 pointer offset 0 size 3072
Register r10 information: non-paged memory
Register r11 information: 2-page vmalloc region starting at 0xdfa40000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796
Register r12 information: 2-page vmalloc region starting at 0xdfa40000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796
Process syz-executor.0 (pid: 13298, stack limit = 0xdfa40000)
Stack: (0xdfa41d00 to 0xdfa42000)
1d00: 804a6614 8027b0a4 855c8a80 dfa41da4 854a0102 854afef1 dfa43000 0000000e
1d20: dfa41d3c dfa41d30 824b3560 824b3560 855c8a80 84c46000 dfa41da4 0000000e
1d40: 00000024 5b930000 dfa41d9c dfa41d58 813e318c 803f2e58 dfa41d9c dfa41d68
1d60: 0000aaaa 00000000 841bb400 dfa43000 dfa41db4 dfa41e40 00000004 0000000e
1d80: dfa43000 83641800 83404800 00000000 dfa41dec dfa41da0 813ae474 813e2fc0
1da0: dfa41ef0 854a0102 854afef1 854a0102 854a0000 85060400 00000000 00020000
1dc0: 00000000 d2f4c1d4 84c46660 00000001 855e52cc 84c47660 00000ebe 855c8a80
1de0: dfa41ea4 dfa41df0 80c29b04 813ae204 00000000 00000400 00000000 00000eb0
1e00: 00000000 83641800 dfa41ea4 dfa41e18 8031cb08 00010040 00000000 83641800
1e20: 00000000 0000ef31 0000fdef 00000000 855e5000 0000fdef 00000000 00080000
1e40: 855c8a80 00000000 00000000 00000000 00000000 00000000 00000400 00000000
1e60: 00000000 d2f4c1d4 8219b2bc 84c46660 84c46000 d2f4c1d4 83641800 dfa41f08
1e80: dfa41ef0 00000000 84c46660 855e5000 20000040 81b6cbe4 dfa41ed4 dfa41ea8
1ea0: 80c2acb8 80c290c4 00000001 00000000 00000008 80c2ac58 846f6d80 0000fdef
1ec0: 83641800 dfa41f68 dfa41f64 dfa41ed8 804f7298 80c2ac64 dfa41f04 dfa41ee8
1ee0: 8020c17c 8020d138 00000000 00000000 00010000 0000fdef 20000040 00000000
1f00: 00000001 00000000 846f6d80 00000000 0000002a 00000000 00000000 00000000
1f20: 00000000 00000000 00000000 00000000 0000fdef d2f4c1d4 83641800 846f6d81
1f40: 846f6d80 0000002a 00000000 80200288 83641800 00000004 dfa41f94 dfa41f68
1f60: 804f75e0 804f7030 0000002a 00000000 80203054 d2f4c1d4 0000fdef 20000040
1f80: 000000c8 00000004 dfa41fa4 dfa41f98 804f7670 804f7574 00000000 dfa41fa8
1fa0: 80200060 804f766c 0000fdef 20000040 000000c8 20000040 0000fdef 00000000
1fc0: 0000fdef 20000040 000000c8 00000004 7ed4d32e 7ed4d32f 003d0f00 76b160fc
1fe0: 0000005c 76b15ef0 00091154 0004f04c 40000010 000000c8 00000000 00000000
Call trace: 
[<803f2e4c>] (dev_map_generic_redirect) from [<813e318c>] (xdp_do_generic_redirect_map net/core/filter.c:4463 [inline])
[<803f2e4c>] (dev_map_generic_redirect) from [<813e318c>] (xdp_do_generic_redirect+0x1d8/0x4d4 net/core/filter.c:4520)
 r10:5b930000 r9:00000024 r8:0000000e r7:dfa41da4 r6:84c46000 r5:855c8a80
 r4:824b3560
[<813e2fb4>] (xdp_do_generic_redirect) from [<813ae474>] (do_xdp_generic+0x27c/0x440 net/core/dev.c:5021)
 r10:00000000 r9:83404800 r8:83641800 r7:dfa43000 r6:0000000e r5:00000004
 r4:dfa41e40
[<813ae1f8>] (do_xdp_generic) from [<80c29b04>] (tun_get_user+0xa4c/0x13f4 drivers/net/tun.c:1924)
 r9:855c8a80 r8:00000ebe r7:84c47660 r6:855e52cc r5:00000001 r4:84c46660
[<80c290b8>] (tun_get_user) from [<80c2acb8>] (tun_chr_write_iter+0x60/0xc8 drivers/net/tun.c:2048)
 r10:81b6cbe4 r9:20000040 r8:855e5000 r7:84c46660 r6:00000000 r5:dfa41ef0
 r4:dfa41f08
[<80c2ac58>] (tun_chr_write_iter) from [<804f7298>] (call_write_iter include/linux/fs.h:2108 [inline])
[<80c2ac58>] (tun_chr_write_iter) from [<804f7298>] (new_sync_write fs/read_write.c:497 [inline])
[<80c2ac58>] (tun_chr_write_iter) from [<804f7298>] (vfs_write+0x274/0x438 fs/read_write.c:590)
 r8:dfa41f68 r7:83641800 r6:0000fdef r5:846f6d80 r4:80c2ac58
[<804f7024>] (vfs_write) from [<804f75e0>] (ksys_write+0x78/0xf8 fs/read_write.c:643)
 r10:00000004 r9:83641800 r8:80200288 r7:00000000 r6:0000002a r5:846f6d80
 r4:846f6d81
[<804f7568>] (ksys_write) from [<804f7670>] (__do_sys_write fs/read_write.c:655 [inline])
[<804f7568>] (ksys_write) from [<804f7670>] (sys_write+0x10/0x14 fs/read_write.c:652)
 r7:00000004 r6:000000c8 r5:20000040 r4:0000fdef
[<804f7660>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66)
Exception stack(0xdfa41fa8 to 0xdfa41ff0)
1fa0:                   0000fdef 20000040 000000c8 20000040 0000fdef 00000000
1fc0: 0000fdef 20000040 000000c8 00000004 7ed4d32e 7ed4d32f 003d0f00 76b160fc
1fe0: 0000005c 76b15ef0 00091154 0004f04c
Code: ee1d9f70 e1a08002 e591a054 e1a06000 (e597508c) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ee1d9f70 	mrc	15, 0, r9, cr13, cr0, {3}
   4:	e1a08002 	mov	r8, r2
   8:	e591a054 	ldr	sl, [r1, #84]	@ 0x54
   c:	e1a06000 	mov	r6, r0
* 10:	e597508c 	ldr	r5, [r7, #140]	@ 0x8c <-- trapping instruction


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup