modbuildid is never set when kallsyms_lookup_buildid is returning via successful bpf_address_lookup.
This leads to an uninitialized pointer dereference on x86 when CONFIG_STACKTRACE_BUILD_ID=y inside __sprint_symbol. Prevent this by always initializing modbuildid. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220717 Signed-off-by: Maurice Hieronymus <[email protected]> --- include/linux/filter.h | 6 ++++-- kernel/kallsyms.c | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/include/linux/filter.h b/include/linux/filter.h index fd54fed8f95f..eb1d1c876503 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -1384,12 +1384,14 @@ struct bpf_prog *bpf_prog_ksym_find(unsigned long addr); static inline int bpf_address_lookup(unsigned long addr, unsigned long *size, - unsigned long *off, char **modname, char *sym) + unsigned long *off, char **modname, const unsigned char **modbuildid, char *sym) { int ret = __bpf_address_lookup(addr, size, off, sym); if (ret && modname) *modname = NULL; + if (ret && modbuildid) + *modbuildid = NULL; return ret; } @@ -1455,7 +1457,7 @@ static inline struct bpf_prog *bpf_prog_ksym_find(unsigned long addr) static inline int bpf_address_lookup(unsigned long addr, unsigned long *size, - unsigned long *off, char **modname, char *sym) + unsigned long *off, char **modname, const unsigned char **modbuildid, char *sym) { return 0; } diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c index 5ca69eafda7a..b1516d3fa9c5 100644 --- a/kernel/kallsyms.c +++ b/kernel/kallsyms.c @@ -378,7 +378,7 @@ static int kallsyms_lookup_buildid(unsigned long addr, modname, modbuildid, namebuf); if (!ret) ret = bpf_address_lookup(addr, symbolsize, - offset, modname, namebuf); + offset, modname, modbuildid, namebuf); if (!ret) ret = ftrace_mod_address_lookup(addr, symbolsize, -- 2.50.1
