modbuildid is never set when kallsyms_lookup_buildid is returning via
successful bpf_address_lookup.

This leads to an uninitialized pointer dereference on x86 when
CONFIG_STACKTRACE_BUILD_ID=y inside __sprint_symbol.

Prevent this by always initializing modbuildid.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220717
Signed-off-by: Maurice Hieronymus <mhi@mailbox.org>
---
 include/linux/filter.h | 6 ++++--
 kernel/kallsyms.c      | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/include/linux/filter.h b/include/linux/filter.h
index fd54fed8f95f..eb1d1c876503 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1384,12 +1384,14 @@ struct bpf_prog *bpf_prog_ksym_find(unsigned long addr);
 
 static inline int
 bpf_address_lookup(unsigned long addr, unsigned long *size,
-		   unsigned long *off, char **modname, char *sym)
+		   unsigned long *off, char **modname, const unsigned char **modbuildid, char *sym)
 {
 	int ret = __bpf_address_lookup(addr, size, off, sym);
 
 	if (ret && modname)
 		*modname = NULL;
+	if (ret && modbuildid)
+		*modbuildid = NULL;
 	return ret;
 }
 
@@ -1455,7 +1457,7 @@ static inline struct bpf_prog *bpf_prog_ksym_find(unsigned long addr)
 
 static inline int
 bpf_address_lookup(unsigned long addr, unsigned long *size,
-		   unsigned long *off, char **modname, char *sym)
+		   unsigned long *off, char **modname, const unsigned char **modbuildid, char *sym)
 {
 	return 0;
 }
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 5ca69eafda7a..b1516d3fa9c5 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -378,7 +378,7 @@ static int kallsyms_lookup_buildid(unsigned long addr,
 				    modname, modbuildid, namebuf);
 	if (!ret)
 		ret = bpf_address_lookup(addr, symbolsize,
-					 offset, modname, namebuf);
+					 offset, modname, modbuildid, namebuf);
 
 	if (!ret)
 		ret = ftrace_mod_address_lookup(addr, symbolsize,
-- 
2.50.1

On Sat, Dec 20, 2025 at 8:19 AM Maurice Hieronymus <mhi@mailbox.org> wrote:
>
> modbuildid is never set when kallsyms_lookup_buildid is returning via
> successful bpf_address_lookup.
>
> This leads to an uninitialized pointer dereference on x86 when
> CONFIG_STACKTRACE_BUILD_ID=y inside __sprint_symbol.
>
> Prevent this by always initializing modbuildid.
>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220717
> Signed-off-by: Maurice Hieronymus <mhi@mailbox.org>
> ---
>  include/linux/filter.h | 6 ++++--
>  kernel/kallsyms.c      | 2 +-
>  2 files changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/include/linux/filter.h b/include/linux/filter.h
> index fd54fed8f95f..eb1d1c876503 100644
> --- a/include/linux/filter.h
> +++ b/include/linux/filter.h
> @@ -1384,12 +1384,14 @@ struct bpf_prog *bpf_prog_ksym_find(unsigned long addr);
>
>  static inline int
>  bpf_address_lookup(unsigned long addr, unsigned long *size,
> -                  unsigned long *off, char **modname, char *sym)
> +                  unsigned long *off, char **modname, const unsigned char **modbuildid, char *sym)
>  {
>         int ret = __bpf_address_lookup(addr, size, off, sym);
>
>         if (ret && modname)
>                 *modname = NULL;
> +       if (ret && modbuildid)
> +               *modbuildid = NULL;
>         return ret;
>  }
>
> @@ -1455,7 +1457,7 @@ static inline struct bpf_prog *bpf_prog_ksym_find(unsigned long addr)
>
>  static inline int
>  bpf_address_lookup(unsigned long addr, unsigned long *size,
> -                  unsigned long *off, char **modname, char *sym)
> +                  unsigned long *off, char **modname, const unsigned char **modbuildid, char *sym)

No.
Please search the earlier threads where this was discussed.
The patches to fix this were posted and I think they landed
in some tree already.

pw-bot: cr