Jann Horn
68d23ee1bd
bpf: Fix theoretical prog_array UAF in __uprobe_perf_func()
...
commit 7d0d673627 upstream.
Currently, the pointer stored in call->prog_array is loaded in
__uprobe_perf_func(), with no RCU annotation and no immediately visible
RCU protection, so it looks as if the loaded pointer can immediately be
dangling.
Later, bpf_prog_run_array_uprobe() starts a RCU-trace read-side critical
section, but this is too late. It then uses rcu_dereference_check(), but
this use of rcu_dereference_check() does not actually dereference anything.
Fix it by aligning the semantics to bpf_prog_run_array(): Let the caller
provide rcu_read_lock_trace() protection and then load call->prog_array
with rcu_dereference_check().
This issue seems to be theoretical: I don't know of any way to reach this
code without having handle_swbp() further up the stack, which is already
holding a rcu_read_lock_trace() lock, so where we take
rcu_read_lock_trace() in __uprobe_perf_func()/bpf_prog_run_array_uprobe()
doesn't actually have any effect.
Fixes: 8c7dcb84e3 ("bpf: implement sleepable uprobes by chaining gps")
Suggested-by: Andrii Nakryiko <andrii@kernel.org >
Signed-off-by: Jann Horn <jannh@google.com >
Signed-off-by: Andrii Nakryiko <andrii@kernel.org >
Link: https://lore.kernel.org/bpf/20241210-bpf-fix-uprobe-uaf-v4-1-5fc8959b2b74@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2024-12-19 18:11:25 +01:00
..
2024-06-27 13:49:11 +02:00
2024-12-09 10:32:02 +01:00
2024-04-27 17:11:29 +02:00
2024-08-29 17:33:45 +02:00
2024-06-12 11:12:23 +02:00
2024-10-22 15:46:19 +02:00
2024-04-27 17:11:33 +02:00
2024-12-14 19:59:46 +01:00
2024-06-12 11:12:21 +02:00
2024-10-22 15:46:35 +02:00
2024-09-18 19:24:08 +02:00
2024-12-14 20:00:00 +01:00
2024-04-03 15:28:58 +02:00
2024-12-14 19:59:35 +01:00
2024-06-21 14:38:34 +02:00
2024-09-12 11:11:32 +02:00
2024-10-04 16:29:22 +02:00
2024-09-08 07:54:43 +02:00
2024-07-25 09:50:47 +02:00
2024-08-19 06:04:23 +02:00
2024-10-04 16:29:50 +02:00
2024-06-12 11:11:37 +02:00
2024-09-12 11:11:40 +02:00
2024-11-14 13:19:38 +01:00
2024-10-04 16:29:59 +02:00
2024-06-12 11:11:38 +02:00
2024-08-14 13:59:02 +02:00
2024-12-09 10:32:56 +01:00
2024-04-27 17:11:43 +02:00
2024-05-25 16:22:53 +02:00
2024-12-09 10:31:42 +01:00
2024-09-12 11:11:34 +02:00
2024-12-19 18:11:25 +01:00
2024-07-25 09:50:40 +02:00
2024-08-19 06:04:31 +02:00
2024-08-14 13:58:56 +02:00
2024-07-05 09:34:04 +02:00
2024-12-09 10:32:46 +01:00
2024-12-09 10:32:46 +01:00
2024-11-08 16:28:20 +01:00
2024-06-12 11:12:14 +02:00
2024-06-12 11:11:24 +02:00
2024-10-10 11:57:58 +02:00
2024-08-29 17:33:14 +02:00
2024-11-22 15:38:35 +01:00
2024-06-12 11:11:57 +02:00
2024-11-08 16:28:24 +01:00
2024-05-17 12:02:27 +02:00
2024-09-04 13:28:24 +02:00
2024-12-14 20:00:16 +01:00
2024-05-02 16:32:46 +02:00
2024-12-14 19:59:58 +01:00
2024-08-29 17:33:31 +02:00
2024-10-04 16:29:37 +02:00
2024-12-14 20:00:05 +01:00
2024-06-12 11:11:56 +02:00
2024-10-10 11:58:00 +02:00
2024-07-09 11:44:29 +02:00
2024-06-12 11:12:51 +02:00
2024-10-04 16:29:48 +02:00
2024-07-25 09:50:57 +02:00
2024-09-08 07:54:44 +02:00
2024-07-11 12:49:16 +02:00
2024-12-14 19:59:45 +01:00
2024-05-17 12:02:15 +02:00
2024-12-14 20:00:00 +01:00
2024-12-09 10:31:48 +01:00
2024-11-08 16:28:27 +01:00
2024-08-03 08:54:11 +02:00
2024-09-08 07:54:43 +02:00
2024-05-17 12:02:17 +02:00
2024-10-10 11:58:01 +02:00
2024-07-05 09:33:51 +02:00
2024-12-09 10:32:59 +01:00
2024-10-17 15:24:26 +02:00
2024-04-10 16:36:02 +02:00
2024-11-08 16:28:19 +01:00
2024-06-21 14:38:30 +02:00
2024-04-17 11:19:36 +02:00
2024-10-17 15:24:13 +02:00
2024-12-09 10:31:50 +01:00
2024-06-27 13:49:13 +02:00
2024-04-13 13:07:38 +02:00
2024-06-27 13:49:03 +02:00
2024-06-16 13:47:41 +02:00
2024-06-12 11:12:52 +02:00
2024-12-14 20:00:12 +01:00
2024-07-05 09:33:57 +02:00
2024-12-09 10:32:45 +01:00
2024-07-11 12:49:18 +02:00
2024-11-01 01:58:25 +01:00
2024-10-17 15:24:10 +02:00
2024-12-14 20:00:17 +01:00
2024-10-04 16:29:21 +02:00
2024-11-22 15:38:37 +01:00
2024-12-09 10:32:59 +01:00
2024-07-18 13:21:10 +02:00
2024-06-27 13:49:14 +02:00
2024-07-11 12:49:02 +02:00
2024-11-01 01:58:29 +01:00
2024-10-17 15:24:29 +02:00
2024-12-09 10:32:12 +01:00
2024-10-17 15:24:23 +02:00
2024-06-12 11:11:50 +02:00
2024-06-12 11:12:53 +02:00
2024-07-05 09:33:53 +02:00
2024-09-18 19:24:04 +02:00
2024-05-17 12:01:55 +02:00
2024-08-03 08:53:38 +02:00
2024-12-09 10:31:56 +01:00
2024-09-04 13:28:22 +02:00
2024-12-09 10:32:59 +01:00
2024-12-09 10:32:59 +01:00
2024-04-13 13:07:32 +02:00
2024-07-25 09:50:56 +02:00
2024-05-02 16:32:47 +02:00
2024-07-18 13:21:20 +02:00
2024-10-17 15:24:22 +02:00
2024-12-14 20:00:14 +01:00
2024-10-10 11:57:27 +02:00
2024-09-12 11:11:40 +02:00
2024-07-11 12:49:11 +02:00
2024-06-12 11:11:56 +02:00
2024-08-14 13:58:47 +02:00
2024-09-18 19:24:03 +02:00
2024-06-12 11:12:24 +02:00
2024-04-13 13:07:40 +02:00
2024-12-09 10:32:59 +01:00
2024-05-17 12:01:59 +02:00
2024-10-04 16:29:38 +02:00
2024-12-14 19:59:50 +01:00
2024-12-14 20:00:19 +01:00
2024-08-11 12:47:16 +02:00
2024-04-10 16:36:04 +02:00
2024-07-11 12:49:18 +02:00
2024-12-09 10:31:51 +01:00
2024-07-05 09:34:00 +02:00
2024-04-27 17:11:42 +02:00
2024-05-17 12:02:20 +02:00
2024-05-17 12:01:59 +02:00
2024-08-29 17:33:23 +02:00
2024-06-16 13:47:49 +02:00
2024-12-09 10:32:10 +01:00
2024-11-22 15:38:32 +01:00
2024-10-10 11:58:08 +02:00
2024-04-27 17:11:42 +02:00
2024-07-05 09:34:04 +02:00
2024-08-11 12:47:13 +02:00
2024-11-01 01:58:20 +01:00
2024-10-17 15:24:23 +02:00
2024-11-08 16:28:16 +01:00
2024-11-14 13:19:37 +01:00
2024-11-01 01:58:19 +01:00
2024-06-12 11:12:35 +02:00
2024-06-27 13:49:05 +02:00
2024-04-17 11:19:28 +02:00
2024-11-08 16:28:26 +01:00
2024-04-27 17:11:32 +02:00
2024-10-10 11:57:36 +02:00
2024-11-14 13:19:39 +01:00
2024-12-09 10:33:06 +01:00
2024-10-10 11:57:17 +02:00
2024-07-05 09:33:45 +02:00
2024-10-04 16:30:02 +02:00