| Message ID | 20220217183001.1876034-1-song@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | d24d2a2b0a81dd5e9bb99aeb4559ec9734e1416f |
| Delegated to: | BPF |
| Headers | show |
| Series | [bpf-next] bpf: bpf_prog_pack: set proper size before freeing ro_header | expand |
Hello: This patch was applied to bpf/bpf-next.git (master) by Alexei Starovoitov <ast@kernel.org>: On Thu, 17 Feb 2022 10:30:01 -0800 you wrote: > bpf_prog_pack_free() uses header->size to decide whether the header > should be freed with module_memfree() or the bpf_prog_pack logic. > However, in kvmalloc() failure path of bpf_jit_binary_pack_alloc(), > header->size is not set yet. As a result, bpf_prog_pack_free() may treat > a slice of a pack as a standalone kvmalloc'd header and call > module_memfree() on the whole pack. This in turn causes use-after-free by > other users of the pack. > > [...] Here is the summary with links: - [bpf-next] bpf: bpf_prog_pack: set proper size before freeing ro_header https://git.kernel.org/bpf/bpf-next/c/d24d2a2b0a81 You are awesome, thank you!
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 44623c9b5bb1..ebb0193d07f0 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -1069,6 +1069,7 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **image_ptr, *rw_header = kvmalloc(size, GFP_KERNEL); if (!*rw_header) { + bpf_arch_text_copy(&ro_header->size, &size, sizeof(size)); bpf_prog_pack_free(ro_header); bpf_jit_uncharge_modmem(size); return NULL;
bpf_prog_pack_free() uses header->size to decide whether the header should be freed with module_memfree() or the bpf_prog_pack logic. However, in kvmalloc() failure path of bpf_jit_binary_pack_alloc(), header->size is not set yet. As a result, bpf_prog_pack_free() may treat a slice of a pack as a standalone kvmalloc'd header and call module_memfree() on the whole pack. This in turn causes use-after-free by other users of the pack. Fix this by setting ro_header->size before freeing ro_header. Fixes: 33c9805860e5 ("bpf: Introduce bpf_jit_binary_pack_[alloc|finalize|free]") Reported-by: syzbot+2f649ec6d2eea1495a8f@syzkaller.appspotmail.com Reported-by: syzbot+ecb1e7e51c52f68f7481@syzkaller.appspotmail.com Reported-by: syzbot+87f65c75f4a72db05445@syzkaller.appspotmail.com Signed-off-by: Song Liu <song@kernel.org> --- kernel/bpf/core.c | 1 + 1 file changed, 1 insertion(+)