Jann Horn 9245459a99 bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors ...

commit ef1b808e3b7c98612feceedf985c2fbbeb28f956 upstream.

Uprobes always use bpf_prog_run_array_uprobe() under tasks-trace-RCU
protection. But it is possible to attach a non-sleepable BPF program to a
uprobe, and non-sleepable BPF programs are freed via normal RCU (see
__bpf_prog_put_noref()). This leads to UAF of the bpf_prog because a normal
RCU grace period does not imply a tasks-trace-RCU grace period.

Fix it by explicitly waiting for a tasks-trace-RCU grace period after
removing the attachment of a bpf_prog to a perf_event.

Fixes: 8c7dcb84e3b7 ("bpf: implement sleepable uprobes by chaining gps")
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/bpf/20241210-bpf-fix-actual-uprobe-uaf-v1-1-19439849dd44@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2024-12-19 18:08:48 +01:00

..

bpf

bpf: Fix helper writes to read-only maps

2024-12-14 19:54:53 +01:00

cgroup

cgroup/bpf: only cgroup v2 can be attached by bpf programs

2024-12-14 19:53:21 +01:00

configs

Kbuild: add Rust support

2022-09-28 09:02:20 +02:00

debug

kdb: Use the passed prompt in kdb_position_cursor()

2024-08-03 08:49:47 +02:00

dma

dma-debug: fix a possible deadlock on radix_lock

2024-12-14 19:54:43 +01:00

entry

entry: Respect changes to system call number by trace_sys_enter()

2024-04-03 15:19:44 +02:00

events

uprobes: fix kernel info leak via "[uprobes]" vma

2024-10-17 15:22:05 +02:00

futex

futex: Don't include process MM in futex key on no-MMU

2023-11-20 11:51:50 +01:00

gcov

gcov: add support for GCC 14

2024-06-27 13:46:22 +02:00

irq

genirq/irqdesc: Honor caller provided affinity in alloc_desc()

2024-08-14 13:52:58 +02:00

kcsan

kcsan: Turn report_filterlist_lock into a raw_spinlock

2024-12-14 19:54:38 +01:00

livepatch

livepatch: Fix missing newline character in klp_resolve_symbols()

2023-11-20 11:52:10 +01:00

locking

lockdep: fix deadlock issue between lockdep and rcu

2024-10-17 15:21:27 +02:00

module

module: Fix KCOV-ignored file name

2024-10-17 15:21:27 +02:00

power

PM: s2idle: Make sure CPUs will wakeup directly on resume

2024-04-17 11:18:22 +02:00

printk

seqlock/latch: Provide raw_read_seqcount_latch_retry()

2024-12-14 19:53:19 +01:00

rcu

rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()

2024-12-14 19:53:56 +01:00

sched

sched/core: Prevent wakeup of ksoftirqd during idle load balance

2024-12-14 19:54:50 +01:00

time

ntp: Remove invalid cast in time offset math

2024-12-14 19:54:26 +01:00

trace

bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors

2024-12-19 18:08:48 +01:00

.gitignore

…

acct.c

acct: fix potential integer overflow in encode_comp_t()

2022-12-31 13:32:58 +01:00

async.c

async: Introduce async_schedule_dev_nocall()

2024-01-31 16:17:00 -08:00

audit_fsnotify.c

audit: fix potential double free on error path from fsnotify_add_inode_mark

2022-08-22 18:50:06 -04:00

audit_tree.c

audit: use fsnotify group lock helpers

2022-04-25 14:37:28 +02:00

audit_watch.c

audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()

2023-11-28 17:07:08 +00:00

audit.c

audit: Send netlink ACK before setting connection in auditd_set

2024-02-05 20:12:47 +00:00

audit.h

audit: remove selinux_audit_rule_update() declaration

2022-09-07 11:30:15 -04:00

auditfilter.c

ima: Avoid blocking in RCU read-side critical section

2024-07-11 12:47:16 +02:00

auditsc.c

audit,io_uring: io_uring openat triggers audit reference count underflow

2023-10-25 12:03:04 +02:00

backtracetest.c

…

bounds.c

bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS

2024-05-02 16:29:32 +02:00

capability.c

xfs: don't generate selinux audit messages for capability testing

2022-03-09 10:32:06 -08:00

cfi.c

cfi: Switch to -fsanitize=kcfi

2022-09-26 10:13:13 -07:00

compat.c

sched_getaffinity: don't assume 'cpumask_size()' is fully initialized

2023-04-06 12:10:40 +02:00

configs.c

…

context_tracking.c

context_tracking: Fix noinstr vs KASAN

2023-03-10 09:33:45 +01:00

cpu_pm.c

context_tracking: Take IRQ eqs entrypoints over RCU

2022-07-05 13:32:59 -07:00

cpu.c

cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked()

2024-07-05 09:31:56 +02:00

crash_core.c

vmcoreinfo: add kallsyms_num_syms symbol

2022-08-28 14:02:44 -07:00

crash_dump.c

…

cred.c

cred: switch to using atomic_long_t

2023-12-20 17:00:20 +01:00

delayacct.c

delayacct: support re-entrance detection of thrashing accounting

2022-09-26 19:46:07 -07:00

dma.c

…

exec_domain.c

…

exit.c

mm: optimize the redundant loop of mm_update_owner_next()

2024-07-11 12:47:13 +02:00

extable.c

context_tracking: Take NMI eqs entrypoints over RCU

2022-07-05 13:32:59 -07:00

fail_function.c

kernel/fail_function: fix memory leak with using debugfs_lookup()

2023-03-11 13:55:39 +01:00

fork.c

posix-cpu-timers: Clear TICK_DEP_BIT_POSIX_TIMER on clone

2024-11-14 13:15:16 +01:00

freezer.c

freezer,sched: Rewrite core freezer logic

2022-09-07 21:53:50 +02:00

gen_kheaders.sh

kheaders: explicitly define file modes for archived headers

2024-06-27 13:46:24 +02:00

groups.c

security: Add LSM hook to setgroups() syscall

2022-07-15 18:21:49 +00:00

hung_task.c

sched: Fix more TASK_state comparisons

2022-09-30 16:50:39 +02:00

iomem.c

…

irq_work.c

irq_work: use kasan_record_aux_stack_noalloc() record callstack

2022-04-15 14:49:55 -07:00

jump_label.c

jump_label: Fix static_key_slow_dec() yet again

2024-10-17 15:21:29 +02:00

kallsyms_internal.h

kallsyms: Reduce the memory occupied by kallsyms_seqs_of_names[]

2023-10-25 12:03:16 +02:00

kallsyms.c

kallsyms: Add helper kallsyms_on_each_match_symbol()

2023-10-25 12:03:16 +02:00

kcmp.c

…

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

…

Kconfig.preempt

Revert "signal, x86: Delay calling signals in atomic on RT enabled kernels"

2022-03-31 10:36:55 +02:00

kcov.c

kcov: properly check for softirq context

2024-08-14 13:52:58 +02:00

kexec_core.c

kexec: fix a memory leak in crash_shrink_memory()

2023-07-19 16:21:08 +02:00

kexec_elf.c

…

kexec_file.c

kexec: support purgatories with .text.hot sections

2023-06-21 16:00:55 +02:00

kexec_internal.h

panic, kexec: make __crash_kexec() NMI safe

2022-09-11 21:55:06 -07:00

kexec.c

kernel: kexec: copy user-array safely

2023-11-28 17:06:57 +00:00

kheaders.c

kheaders: Use array declaration instead of char

2023-05-11 23:03:02 +09:00

kmod.c

…

kprobes.c

kprobes: Fix to check symbol prefixes correctly

2024-08-14 13:52:54 +02:00

ksysfs.c

kexec: turn all kexec_mutex acquisitions into trylocks

2022-09-11 21:55:06 -07:00

kthread.c

kthread: unpark only parked kthread

2024-10-17 15:22:28 +02:00

latencytop.c

latencytop: use the last element of latency_record of system

2022-09-11 21:55:12 -07:00

Makefile

kernel/numa.c: Move logging out of numa.h

2024-06-12 11:03:16 +02:00

module_signature.c

…

notifier.c

notifier: Add blocking/atomic_notifier_chain_register_unique_prio()

2022-05-19 19:30:30 +02:00

nsproxy.c

Revert "fs/exec: allow to unshare a time namespace on vfork+exec"

2022-09-13 10:38:43 -07:00

numa.c

kernel/numa.c: Move logging out of numa.h

2024-06-12 11:03:16 +02:00

padata.c

padata: use integer wrap around to prevent deadlock on seq_nr overflow

2024-10-17 15:21:24 +02:00

panic.c

panic: Flush kernel log buffer at the end

2024-04-13 13:04:54 +02:00

params.c

kobject: remove kset from struct kset_uevent_ops callbacks

2021-12-28 11:26:18 +01:00

pid_namespace.c

pid: Replace struct pid 1-element array with flex-array

2024-08-29 17:30:18 +02:00

pid.c

pid: Replace struct pid 1-element array with flex-array

2024-08-29 17:30:18 +02:00

profile.c

profiling: remove profile=sleep support

2024-08-14 13:52:50 +02:00

ptrace.c

freezer,sched: Rewrite core freezer logic

2022-09-07 21:53:50 +02:00

range.c

…

reboot.c

kernel/reboot: emergency_restart: Set correct system_state

2023-11-28 17:07:13 +00:00

regset.c

…

relay.c

relayfs: fix out-of-bounds access in relay_file_read

2023-05-11 23:03:03 +09:00

resource_kunit.c

…

resource.c

resource: fix region_intersects() vs add_memory_driver_managed()

2024-10-17 15:21:55 +02:00

rseq.c

rseq: Use pr_warn_once() when deprecated/unknown ABI flags are encountered

2022-11-14 09:58:32 +01:00

scftorture.c

scftorture: Forgive memory-allocation failure if KASAN

2023-09-23 11:11:00 +02:00

scs.c

kasan, vmalloc: only tag normal vmalloc allocations

2022-03-24 19:06:48 -07:00

seccomp.c

seccomp: Add wait_killable semantic to seccomp user notifier

2022-05-03 14:11:58 -07:00

signal.c

signal: restore the override_rlimit logic

2024-11-14 13:15:18 +01:00

smp.c

smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()

2024-09-12 11:10:24 +02:00

smpboot.c

smpboot: use atomic_try_cmpxchg in cpu_wait_death and cpu_report_death

2022-09-11 21:55:10 -07:00

smpboot.h

…

softirq.c

softirq: Fix suspicious RCU usage in __do_softirq()

2024-06-12 11:03:01 +02:00

stackleak.c

stackleak: add on/off stack variants

2022-05-08 01:33:09 -07:00

stacktrace.c

uaccess: remove CONFIG_SET_FS

2022-02-25 09:36:06 +01:00

static_call_inline.c

static_call: Replace pointless WARN_ON() in static_call_module_notify()

2024-10-17 15:21:29 +02:00

static_call.c

static_call: Don't make __static_call_return0 static

2022-04-05 09:59:38 +02:00

stop_machine.c

Scheduler changes in this cycle were:

2022-05-24 11:11:13 -07:00

sys_ni.c

syscalls: fix compat_sys_io_pgetevents_time64 usage

2024-07-05 09:31:59 +02:00

sys.c

getrusage: use sig->stats_lock rather than lock_task_sighand()

2024-03-15 10:48:22 -04:00

sysctl-test.c

kernel/sysctl-test: use SYSCTL_{ZERO/ONE_HUNDRED} instead of i_{zero/one_hundred}

2022-09-08 16:56:45 -07:00

sysctl.c

proc: proc_skip_spaces() shouldn't think it is working on C strings

2022-12-05 12:09:06 -08:00

task_work.c

task_work: Introduce task_work_cancel() again

2024-08-03 08:49:34 +02:00

taskstats.c

genetlink: start to validate reserved header bytes

2022-08-29 12:47:15 +01:00

torture.c

torture: Fix hang during kthread shutdown phase

2023-03-10 09:34:07 +01:00

tracepoint.c

tracepoint: Optimize the critical region of mutex_lock in tracepoint_module_coming()

2022-09-26 13:01:18 -04:00

tsacct.c

taskstats: version 12 with thread group and exe info

2022-04-29 14:38:03 -07:00

ucount.c

ucounts: fix counter leak in inc_rlimit_get_ucounts()

2024-11-14 13:15:19 +01:00

uid16.c

…

uid16.h

…

umh.c

freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL

2023-02-22 12:59:50 +01:00

up.c

…

user_namespace.c

ucounts: Split rlimit and ucount values and max values

2022-10-09 16:24:05 -07:00

user-return-notifier.c

…

user.c

…

usermode_driver.c

blob_to_mnt(): kern_unmount() is needed to undo kern_mount()

2022-05-19 23:25:47 -04:00

utsname_sysctl.c

kernel/utsname_sysctl.c: Fix hostname polling

2022-10-23 12:01:01 -07:00

utsname.c

…

watch_queue.c

kernel: watch_queue: copy user-array safely

2023-11-28 17:06:57 +00:00

watchdog_hld.c

watchdog/perf: properly initialize the turbo mode timestamp and rearm counter

2024-08-03 08:49:42 +02:00

watchdog.c

watchdog: move softlockup_panic back to early_param

2023-11-28 17:07:09 +00:00

workqueue_internal.h

…

workqueue.c

workqueue: Improve scalability of workqueue watchdog touch

2024-09-12 11:10:27 +02:00