[PATCH v4 2/2] kallsyms: Always initialize modbuildid on bpf address
From: Maurice Hieronymus
Date: Sat Dec 20 2025 - 13:19:11 EST
modbuildid is never set when kallsyms_lookup_buildid is returning via
successful bpf_address_lookup.
This leads to an uninitialized pointer dereference on x86 when
CONFIG_STACKTRACE_BUILD_ID=y inside __sprint_symbol.
Prevent this by always initializing modbuildid.
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220717
Signed-off-by: Maurice Hieronymus <mhi@xxxxxxxxxxx>
---
include/linux/filter.h | 6 ++++--
kernel/kallsyms.c | 2 +-
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index fd54fed8f95f..eb1d1c876503 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1384,12 +1384,14 @@ struct bpf_prog *bpf_prog_ksym_find(unsigned long addr);
static inline int
bpf_address_lookup(unsigned long addr, unsigned long *size,
- unsigned long *off, char **modname, char *sym)
+ unsigned long *off, char **modname, const unsigned char **modbuildid, char *sym)
{
int ret = __bpf_address_lookup(addr, size, off, sym);
if (ret && modname)
*modname = NULL;
+ if (ret && modbuildid)
+ *modbuildid = NULL;
return ret;
}
@@ -1455,7 +1457,7 @@ static inline struct bpf_prog *bpf_prog_ksym_find(unsigned long addr)
static inline int
bpf_address_lookup(unsigned long addr, unsigned long *size,
- unsigned long *off, char **modname, char *sym)
+ unsigned long *off, char **modname, const unsigned char **modbuildid, char *sym)
{
return 0;
}
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 5ca69eafda7a..b1516d3fa9c5 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -378,7 +378,7 @@ static int kallsyms_lookup_buildid(unsigned long addr,
modname, modbuildid, namebuf);
if (!ret)
ret = bpf_address_lookup(addr, symbolsize,
- offset, modname, namebuf);
+ offset, modname, modbuildid, namebuf);
if (!ret)
ret = ftrace_mod_address_lookup(addr, symbolsize,
--
2.50.1