)]}'
{
  "commit": "65073a67331de3d2cce35607807ddec284e75e81",
  "tree": "aa39697a25f7b47548ca227b13d866558c9b98ce",
  "parents": [
    "62a06994ced17f295fc51ea0815580ee7ccb668d"
  ],
  "author": {
    "name": "Daniel Borkmann",
    "email": "daniel@iogearbox.net",
    "time": "Wed Jan 31 12:58:56 2018 +0100"
  },
  "committer": {
    "name": "Alexei Starovoitov",
    "email": "ast@kernel.org",
    "time": "Thu Feb 01 07:43:56 2018 -0800"
  },
  "message": "bpf: fix null pointer deref in bpf_prog_test_run_xdp\n\nsyzkaller was able to generate the following XDP program ...\n\n  (18) r0 \u003d 0x0\n  (61) r5 \u003d *(u32 *)(r1 +12)\n  (04) (u32) r0 +\u003d (u32) 0\n  (95) exit\n\n... and trigger a NULL pointer dereference in ___bpf_prog_run()\nvia bpf_prog_test_run_xdp() where this was attempted to run.\n\nReason is that recent xdp_rxq_info addition to XDP programs\nupdated all drivers, but not bpf_prog_test_run_xdp(), where\nxdp_buff is set up. Thus when context rewriter does the deref\non the netdev it\u0027s NULL at runtime. Fix it by using xdp_rxq\nfrom loopback dev. __netif_get_rx_queue() helper can also be\nreused in various other locations later on.\n\nFixes: 02dd3291b2f0 (\"bpf: finally expose xdp_rxq_info to XDP bpf-programs\")\nReported-by: syzbot+1eb094057b338eb1fc00@syzkaller.appspotmail.com\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nCc: Jesper Dangaard Brouer \u003cbrouer@redhat.com\u003e\nAcked-by: Jesper Dangaard Brouer \u003cbrouer@redhat.com\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "4c77f39ebd65e60d2b7491065771566aadc12ce5",
      "old_mode": 33188,
      "old_path": "include/linux/netdevice.h",
      "new_id": "5eef6c8e274199d4f37e30cb463fc19d13868b3c",
      "new_mode": 33188,
      "new_path": "include/linux/netdevice.h"
    },
    {
      "type": "modify",
      "old_id": "a86e6687026eecb53d853c40309d7fc96e8e99d5",
      "old_mode": 33188,
      "old_path": "net/bpf/test_run.c",
      "new_id": "2ced48662c1faaa41998fb875ef5d5aa1d20aaab",
      "new_mode": 33188,
      "new_path": "net/bpf/test_run.c"
    },
    {
      "type": "modify",
      "old_id": "697bd83de295524d3f1c1f423a7ba503c9e2fcd4",
      "old_mode": 33188,
      "old_path": "tools/testing/selftests/bpf/test_verifier.c",
      "new_id": "c0f16e93f9bd14b3ef98b323c6830ca14645509b",
      "new_mode": 33188,
      "new_path": "tools/testing/selftests/bpf/test_verifier.c"
    }
  ]
}