Skip to content

bpf: fix UAF of trampoline progs before image release #13316

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kernel-patches-daemon-bpf wants to merge 1 commit into from
+25 −0
Closed

bpf: fix UAF of trampoline progs before image release #13316

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions include/linux/bpf.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1376,6 +1376,11 @@ struct bpf_tramp_image {
struct rcu_head rcu;
struct work_struct work;
};
#ifdef CONFIG_PREEMPTION
/* Programs called from this image must outlive deferred image freeing. */
struct bpf_prog *progs[BPF_MAX_TRAMP_LINKS];
int nr_progs;
#endif
};

struct bpf_trampoline {
Expand Down
20 changes: 20 additions & 0 deletions kernel/bpf/trampoline.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -531,6 +531,13 @@ bpf_trampoline_get_progs(const struct bpf_trampoline *tr, int *total, bool *ip_a

static void bpf_tramp_image_free(struct bpf_tramp_image *im)
{
#ifdef CONFIG_PREEMPTION
int i;

for (i = 0; i < im->nr_progs; i++)
bpf_prog_put(im->progs[i]);
#endif

bpf_image_ksym_del(&im->ksym);
arch_free_bpf_trampoline(im->image, im->size);
bpf_jit_uncharge_modmem(im->size);
Expand Down Expand Up @@ -678,6 +685,9 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
u32 orig_flags = tr->flags;
bool ip_arg = false;
int err, total, size;
#ifdef CONFIG_PREEMPTION
int i, kind;
#endif

tnodes = bpf_trampoline_get_progs(tr, &total, &ip_arg);
if (IS_ERR(tnodes))
Expand Down Expand Up @@ -740,6 +750,16 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
goto out;
}

#ifdef CONFIG_PREEMPTION
for (kind = 0; kind < BPF_TRAMP_MAX; kind++)
for (i = 0; i < tnodes[kind].nr_nodes; i++) {
struct bpf_prog *prog = tnodes[kind].nodes[i]->link->prog;

bpf_prog_inc(prog);
im->progs[im->nr_progs++] = prog;
}
#endif

err = arch_prepare_bpf_trampoline(im, im->image, im->image + size,
&tr->func.model, tr->flags, tnodes,
tr->func.addr);
Expand Down
Loading