From patchwork Fri Mar 8 21:15:37 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1909866 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4TrzVh3Dm2z1yX6 for ; Sat, 9 Mar 2024 08:16:12 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1rihZU-0006US-Em; Fri, 08 Mar 2024 21:16:04 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rihZP-0006Re-7C for kernel-team@lists.ubuntu.com; Fri, 08 Mar 2024 21:15:59 +0000 Received: from mail-qv1-f72.google.com (mail-qv1-f72.google.com [209.85.219.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id EED9941120 for ; Fri, 8 Mar 2024 21:15:58 +0000 (UTC) Received: by mail-qv1-f72.google.com with SMTP id 6a1803df08f44-690b861a1c0so10020736d6.1 for ; Fri, 08 Mar 2024 13:15:58 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709932558; x=1710537358; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=JlVp7Y/aNhm1C6R8rMgy4OcptWP8zUR8zvUA3vTO+tQ=; b=WJ+DWyXgrQ5XDxGXM4oI77X62TJnCrjArifTJqohxOYWl8GKiClicUZawD2Mb/L4bW R5jThPE8bhX9jjmOFtLatiLkFodw4Vnm/63nb+KdyiBrtuCUV4oyaQjCvb9Ta6MuhI3f +xhiRHsa6b28TtfJI4moIV+nWpDDEE1umf7bl9VfsDUtbKVUuTmyjosD1TOrHcxgV0zk u6O45Q5rMEpvAD9n/shABXypGzL/ya2Mbbe1H2vlRWdwOdqlSjWm8K+xslqZFGDND5ic nrFGNTLqdc0SCb5zrBSV+PaVLfE5t5ZP94KTLsMnCph7wPP8c6e92BD5tv9CZo1JRMgT LQ0A== X-Gm-Message-State: AOJu0YyUOd/TGiKdgvpHPJQ6R8kl6T7xuJl8LdDEUdyQEMko+G8pI00a 19fQTWYaBnEevidDW0A2il1nkldQHsguoduyjNibP/5MOoRt3bhnPP4RUqDKhnEfkHXWe4d8yeL QEGh2h1qM6VgnE813zwqwrbAJH82FYJO48jO4sZSsTMF1lG97AKJvtcmTqnaFX1jCVWZZ8g2RDX bfO0O0IFViVg== X-Received: by 2002:a05:6214:564d:b0:690:a833:a273 with SMTP id mh13-20020a056214564d00b00690a833a273mr298016qvb.55.1709932557867; Fri, 08 Mar 2024 13:15:57 -0800 (PST) X-Google-Smtp-Source: AGHT+IFzvQb5ytZ1rBhoo3m1/vtSSaq8kZZz8/xAsTBP7RDU/C4y260Uj09yBPwxR/Mu9k3/189njw== X-Received: by 2002:a05:6214:564d:b0:690:a833:a273 with SMTP id mh13-20020a056214564d00b00690a833a273mr297217qvb.55.1709932540278; Fri, 08 Mar 2024 13:15:40 -0800 (PST) Received: from smtp.gmail.com (104-218-69-129.dynamic.lnk.ne.allofiber.net. [104.218.69.129]) by smtp.gmail.com with ESMTPSA id cz14-20020a056214088e00b0068f4520e42dsm126531qvb.16.2024.03.08.13.15.39 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 08 Mar 2024 13:15:40 -0800 (PST) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][M][PATCH 1/1] bpf: Fix re-attachment branch in bpf_tracing_prog_attach Date: Fri, 8 Mar 2024 15:15:37 -0600 Message-Id: <20240308211537.31181-2-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240308211537.31181-1-bethany.jamison@canonical.com> References: <20240308211537.31181-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Jiri Olsa The following case can cause a crash due to missing attach_btf: 1) load rawtp program 2) load fentry program with rawtp as target_fd 3) create tracing link for fentry program with target_fd = 0 4) repeat 3 In the end we have: - prog->aux->dst_trampoline == NULL - tgt_prog == NULL (because we did not provide target_fd to link_create) - prog->aux->attach_btf == NULL (the program was loaded with attach_prog_fd=X) - the program was loaded for tgt_prog but we have no way to find out which one BUG: kernel NULL pointer dereference, address: 0000000000000058 Call Trace: ? __die+0x20/0x70 ? page_fault_oops+0x15b/0x430 ? fixup_exception+0x22/0x330 ? exc_page_fault+0x6f/0x170 ? asm_exc_page_fault+0x22/0x30 ? bpf_tracing_prog_attach+0x279/0x560 ? btf_obj_id+0x5/0x10 bpf_tracing_prog_attach+0x439/0x560 __sys_bpf+0x1cf4/0x2de0 __x64_sys_bpf+0x1c/0x30 do_syscall_64+0x41/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Return -EINVAL in this situation. Fixes: f3a95075549e0 ("bpf: Allow trampoline re-attach for tracing and lsm programs") Cc: stable@vger.kernel.org Signed-off-by: Jiri Olsa Acked-by: Jiri Olsa Acked-by: Song Liu Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com> Link: https://lore.kernel.org/r/20240103190559.14750-4-9erthalion6@gmail.com Signed-off-by: Alexei Starovoitov (cherry picked from commit 715d82ba636cb3629a6e18a33bb9dbe53f9936ee) CVE-2024-26591 Signed-off-by: Bethany Jamison --- kernel/bpf/syscall.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 1480b6cf12f06..d72f816a00f68 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -3168,6 +3168,10 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, * * - if prog->aux->dst_trampoline and tgt_prog is NULL, the program * was detached and is going for re-attachment. + * + * - if prog->aux->dst_trampoline is NULL and tgt_prog and prog->aux->attach_btf + * are NULL, then program was already attached and user did not provide + * tgt_prog_fd so we have no way to find out or create trampoline */ if (!prog->aux->dst_trampoline && !tgt_prog) { /* @@ -3181,6 +3185,11 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, err = -EINVAL; goto out_unlock; } + /* We can allow re-attach only if we have valid attach_btf. */ + if (!prog->aux->attach_btf) { + err = -EINVAL; + goto out_unlock; + } btf_id = prog->aux->attach_btf_id; key = bpf_trampoline_compute_key(NULL, prog->aux->attach_btf, btf_id); }