Skip to content

Commit d0d1df8

Browse files
olsajiriborkmann
authored andcommitted
bpf: Set run context for rawtp test_run callback
syzbot reported crash when rawtp program executed through the test_run interface calls bpf_get_attach_cookie helper or any other helper that touches task->bpf_ctx pointer. Setting the run context (task->bpf_ctx pointer) for test_run callback. Fixes: 7adfc6c ("bpf: Add bpf_get_attach_cookie() BPF helper to access bpf_cookie value") Reported-by: [email protected] Signed-off-by: Jiri Olsa <[email protected]> Signed-off-by: Andrii Nakryiko <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> Closes: https://syzkaller.appspot.com/bug?extid=3ab78ff125b7979e45f9 Link: https://lore.kernel.org/bpf/[email protected]
1 parent 2884dc7 commit d0d1df8

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

net/bpf/test_run.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -727,10 +727,16 @@ static void
727727
__bpf_prog_test_run_raw_tp(void *data)
728728
{
729729
struct bpf_raw_tp_test_run_info *info = data;
730+
struct bpf_trace_run_ctx run_ctx = {};
731+
struct bpf_run_ctx *old_run_ctx;
732+
733+
old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
730734

731735
rcu_read_lock();
732736
info->retval = bpf_prog_run(info->prog, info->ctx);
733737
rcu_read_unlock();
738+
739+
bpf_reset_run_ctx(old_run_ctx);
734740
}
735741

736742
int bpf_prog_test_run_raw_tp(struct bpf_prog *prog,

0 commit comments

Comments
 (0)