Hello, The following program causes kernel NULL pointer dereference in map_get_next_key:
BUG: unable to handle kernel NULL pointer dereference at (null) IP: (null) PGD 64a8f067 PUD 65c78067 PMD 0 Oops: 0010 [#1] SMP KASAN Modules linked in: CPU: 3 PID: 2953 Comm: a.out Not tainted 4.10.0+ #297 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88006b6d4240 task.stack: ffff880069670000 RIP: 0010: (null) RSP: 0018:ffff880069677610 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff880066804bc8 RCX: 1ffff1000d2ceeb6 RDX: ffff88006c971240 RSI: ffff88006c971200 RDI: ffff880066804bc0 RBP: ffff880069677f48 R08: 000000004d6b4af0 R09: 0000000000000000 R10: dffffc0000000000 R11: 643f6e6862766c3c R12: ffffffff846de800 R13: ffff88006c971200 R14: ffff880066804bc0 R15: ffff880069677ec0 FS: 0000000002285880(0000) GS:ffff88006cf80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000064fad000 CR4: 00000000001406e0 Call Trace: entry_SYSCALL_64_fastpath+0x1f/0xc2 RIP: 0033:0x434ae9 RSP: 002b:00007ffdb4a47258 EFLAGS: 00000203 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 0000000000401840 RCX: 0000000000434ae9 RDX: 0000000000000018 RSI: 00000000200030ad RDI: 0000000000000004 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000203 R12: 00000000004002b0 R13: 0000000000401840 R14: 00000000004018d0 R15: 0000000000000000 Code: Bad RIP value. RIP: (null) RSP: ffff880069677610 CR2: 0000000000000000 ---[ end trace 33dfce8e7f877b5e ]--- // autogenerated by syzkaller (http://github.com/google/syzkaller) #include <sys/syscall.h> #include <stdint.h> int main() { int fd; syscall(__NR_mmap, 0x20000000ul, 0x5000ul, 0x3ul, 0x32ul, -1, 0); (*(uint32_t*)0x20001fec = (uint32_t)0xb); (*(uint32_t*)0x20001ff0 = (uint32_t)0x6); (*(uint32_t*)0x20001ff4 = (uint32_t)0x5); (*(uint32_t*)0x20001ff8 = (uint32_t)0x1); (*(uint32_t*)0x20001ffc = (uint32_t)0x1); fd = syscall(__NR_bpf, 0x0ul, 0x20001fecul, 0x14ul); (*(uint32_t*)0x200030ad = fd); (*(uint64_t*)0x200030b5 = (uint64_t)0x20004000); (*(uint64_t*)0x200030bd = (uint64_t)0x20001000); syscall(__NR_bpf, 0x4ul, 0x200030adul, 0x18ul); return 0; } On commit 0710f3ff91ecc4a715db6e4d0690472b13c4dac6
