Toke Høiland-Jørgensen eb485fbdc2 bpf: fix kfunc btf caching for modules ... [ Upstream commit 6cb86a0fde ] The verifier contains a cache for looking up module BTF objects when calling kfuncs defined in modules. This cache uses a 'struct bpf_kfunc_btf_tab', which contains a sorted list of BTF objects that were already seen in the current verifier run, and the BTF objects are looked up by the offset stored in the relocated call instruction using bsearch(). The first time a given offset is seen, the module BTF is loaded from the file descriptor passed in by libbpf, and stored into the cache. However, there's a bug in the code storing the new entry: it stores a pointer to the new cache entry, then calls sort() to keep the cache sorted for the next lookup using bsearch(), and then returns the entry that was just stored through the stored pointer. However, because sort() modifies the list of entries in place *by value*, the stored pointer may no longer point to the right entry, in which case the wrong BTF object will be returned. The end result of this is an intermittent bug where, if a BPF program calls two functions with the same signature in two different modules, the function from the wrong module may sometimes end up being called. Whether this happens depends on the order of the calls in the BPF program (as that affects whether sort() reorders the array of BTF objects), making it especially hard to track down. Simon, credited as reporter below, spent significant effort analysing and creating a reproducer for this issue. The reproducer is added as a selftest in a subsequent patch. The fix is straight forward: simply don't use the stored pointer after calling sort(). Since we already have an on-stack pointer to the BTF object itself at the point where the function return, just use that, and populate it from the cache entry in the branch where the lookup succeeds. Fixes: 2357672c54 ("bpf: Introduce BPF support for kernel module function calls") Reported-by: Simon Sundberg <simon.sundberg@kau.se> Acked-by: Jiri Olsa <jolsa@kernel.org> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Link: https://lore.kernel.org/r/20241010-fix-kfunc-btf-caching-for-modules-v2-1-745af6c1af98@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-11-01 01:55:57 +01:00
..
bpf	bpf: fix kfunc btf caching for modules	2024-11-01 01:55:57 +01:00
cgroup	cgroup: Protect css->cgroup write under css_set_lock	2024-09-12 11:10:22 +02:00
configs	Kbuild: add Rust support	2022-09-28 09:02:20 +02:00
debug	kdb: Use the passed prompt in kdb_position_cursor()	2024-08-03 08:49:47 +02:00
dma	dma-mapping: benchmark: Don't starve others when doing the test	2024-09-12 11:10:23 +02:00
entry	entry: Respect changes to system call number by trace_sys_enter()	2024-04-03 15:19:44 +02:00
events	uprobes: fix kernel info leak via "[uprobes]" vma	2024-10-17 15:22:05 +02:00
futex	futex: Don't include process MM in futex key on no-MMU	2023-11-20 11:51:50 +01:00
gcov	gcov: add support for GCC 14	2024-06-27 13:46:22 +02:00
irq	genirq/irqdesc: Honor caller provided affinity in alloc_desc()	2024-08-14 13:52:58 +02:00
kcsan	kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures	2023-07-19 16:21:37 +02:00
livepatch	livepatch: Fix missing newline character in klp_resolve_symbols()	2023-11-20 11:52:10 +01:00
locking	lockdep: fix deadlock issue between lockdep and rcu	2024-10-17 15:21:27 +02:00
module	module: Fix KCOV-ignored file name	2024-10-17 15:21:27 +02:00
power	PM: s2idle: Make sure CPUs will wakeup directly on resume	2024-04-17 11:18:22 +02:00
printk	printk: Update @console_may_schedule in console_trylock_spinning()	2024-04-03 15:19:44 +02:00
rcu	rcuscale: Provide clear error when async specified without primitives	2024-10-17 15:21:42 +02:00
sched	sched: psi: fix bogus pressure spikes from aggregation race	2024-10-17 15:22:06 +02:00
time	posix-clock: Fix missing timespec64 check in pc_clock_settime()	2024-10-22 15:56:42 +02:00
trace	tracing: Have saved_cmdlines arrays all in one allocation	2024-10-17 15:22:10 +02:00
.gitignore
acct.c	acct: fix potential integer overflow in encode_comp_t()	2022-12-31 13:32:58 +01:00
async.c	async: Introduce async_schedule_dev_nocall()	2024-01-31 16:17:00 -08:00
audit_fsnotify.c	audit: fix potential double free on error path from fsnotify_add_inode_mark	2022-08-22 18:50:06 -04:00
audit_tree.c	audit: use fsnotify group lock helpers	2022-04-25 14:37:28 +02:00
audit_watch.c	audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()	2023-11-28 17:07:08 +00:00
audit.c	audit: Send netlink ACK before setting connection in auditd_set	2024-02-05 20:12:47 +00:00
audit.h	audit: remove selinux_audit_rule_update() declaration	2022-09-07 11:30:15 -04:00
auditfilter.c	ima: Avoid blocking in RCU read-side critical section	2024-07-11 12:47:16 +02:00
auditsc.c	audit,io_uring: io_uring openat triggers audit reference count underflow	2023-10-25 12:03:04 +02:00
backtracetest.c
bounds.c	bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS	2024-05-02 16:29:32 +02:00
capability.c	xfs: don't generate selinux audit messages for capability testing	2022-03-09 10:32:06 -08:00
cfi.c	cfi: Switch to -fsanitize=kcfi	2022-09-26 10:13:13 -07:00
compat.c	sched_getaffinity: don't assume 'cpumask_size()' is fully initialized	2023-04-06 12:10:40 +02:00
configs.c
context_tracking.c	context_tracking: Fix noinstr vs KASAN	2023-03-10 09:33:45 +01:00
cpu_pm.c	context_tracking: Take IRQ eqs entrypoints over RCU	2022-07-05 13:32:59 -07:00
cpu.c	cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked()	2024-07-05 09:31:56 +02:00
crash_core.c	vmcoreinfo: add kallsyms_num_syms symbol	2022-08-28 14:02:44 -07:00
crash_dump.c
cred.c	cred: switch to using atomic_long_t	2023-12-20 17:00:20 +01:00
delayacct.c	delayacct: support re-entrance detection of thrashing accounting	2022-09-26 19:46:07 -07:00
dma.c
exec_domain.c
exit.c	mm: optimize the redundant loop of mm_update_owner_next()	2024-07-11 12:47:13 +02:00
extable.c	context_tracking: Take NMI eqs entrypoints over RCU	2022-07-05 13:32:59 -07:00
fail_function.c	kernel/fail_function: fix memory leak with using debugfs_lookup()	2023-03-11 13:55:39 +01:00
fork.c	close_range(): fix the logics in descriptor table trimming	2024-10-17 15:22:03 +02:00
freezer.c	freezer,sched: Rewrite core freezer logic	2022-09-07 21:53:50 +02:00
gen_kheaders.sh	kheaders: explicitly define file modes for archived headers	2024-06-27 13:46:24 +02:00
groups.c	security: Add LSM hook to setgroups() syscall	2022-07-15 18:21:49 +00:00
hung_task.c	sched: Fix more TASK_state comparisons	2022-09-30 16:50:39 +02:00
iomem.c
irq_work.c	irq_work: use kasan_record_aux_stack_noalloc() record callstack	2022-04-15 14:49:55 -07:00
jump_label.c	jump_label: Fix static_key_slow_dec() yet again	2024-10-17 15:21:29 +02:00
kallsyms_internal.h	kallsyms: Reduce the memory occupied by kallsyms_seqs_of_names[]	2023-10-25 12:03:16 +02:00
kallsyms.c	kallsyms: Add helper kallsyms_on_each_match_symbol()	2023-10-25 12:03:16 +02:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt	Revert "signal, x86: Delay calling signals in atomic on RT enabled kernels"	2022-03-31 10:36:55 +02:00
kcov.c	kcov: properly check for softirq context	2024-08-14 13:52:58 +02:00
kexec_core.c	kexec: fix a memory leak in crash_shrink_memory()	2023-07-19 16:21:08 +02:00
kexec_elf.c
kexec_file.c	kexec: support purgatories with .text.hot sections	2023-06-21 16:00:55 +02:00
kexec_internal.h	panic, kexec: make __crash_kexec() NMI safe	2022-09-11 21:55:06 -07:00
kexec.c	kernel: kexec: copy user-array safely	2023-11-28 17:06:57 +00:00
kheaders.c	kheaders: Use array declaration instead of char	2023-05-11 23:03:02 +09:00
kmod.c
kprobes.c	kprobes: Fix to check symbol prefixes correctly	2024-08-14 13:52:54 +02:00
ksysfs.c	kexec: turn all kexec_mutex acquisitions into trylocks	2022-09-11 21:55:06 -07:00
kthread.c	kthread: unpark only parked kthread	2024-10-17 15:22:28 +02:00
latencytop.c	latencytop: use the last element of latency_record of system	2022-09-11 21:55:12 -07:00
Makefile	kernel/numa.c: Move logging out of numa.h	2024-06-12 11:03:16 +02:00
module_signature.c
notifier.c	notifier: Add blocking/atomic_notifier_chain_register_unique_prio()	2022-05-19 19:30:30 +02:00
nsproxy.c	Revert "fs/exec: allow to unshare a time namespace on vfork+exec"	2022-09-13 10:38:43 -07:00
numa.c	kernel/numa.c: Move logging out of numa.h	2024-06-12 11:03:16 +02:00
padata.c	padata: use integer wrap around to prevent deadlock on seq_nr overflow	2024-10-17 15:21:24 +02:00
panic.c	panic: Flush kernel log buffer at the end	2024-04-13 13:04:54 +02:00
params.c	kobject: remove kset from struct kset_uevent_ops callbacks	2021-12-28 11:26:18 +01:00
pid_namespace.c	pid: Replace struct pid 1-element array with flex-array	2024-08-29 17:30:18 +02:00
pid.c	pid: Replace struct pid 1-element array with flex-array	2024-08-29 17:30:18 +02:00
profile.c	profiling: remove profile=sleep support	2024-08-14 13:52:50 +02:00
ptrace.c	freezer,sched: Rewrite core freezer logic	2022-09-07 21:53:50 +02:00
range.c
reboot.c	kernel/reboot: emergency_restart: Set correct system_state	2023-11-28 17:07:13 +00:00
regset.c
relay.c	relayfs: fix out-of-bounds access in relay_file_read	2023-05-11 23:03:03 +09:00
resource_kunit.c
resource.c	resource: fix region_intersects() vs add_memory_driver_managed()	2024-10-17 15:21:55 +02:00
rseq.c	rseq: Use pr_warn_once() when deprecated/unknown ABI flags are encountered	2022-11-14 09:58:32 +01:00
scftorture.c	scftorture: Forgive memory-allocation failure if KASAN	2023-09-23 11:11:00 +02:00
scs.c	kasan, vmalloc: only tag normal vmalloc allocations	2022-03-24 19:06:48 -07:00
seccomp.c	seccomp: Add wait_killable semantic to seccomp user notifier	2022-05-03 14:11:58 -07:00
signal.c	kernel: rerun task_work while freezing in get_signal()	2024-08-03 08:49:31 +02:00
smp.c	smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()	2024-09-12 11:10:24 +02:00
smpboot.c	smpboot: use atomic_try_cmpxchg in cpu_wait_death and cpu_report_death	2022-09-11 21:55:10 -07:00
smpboot.h
softirq.c	softirq: Fix suspicious RCU usage in __do_softirq()	2024-06-12 11:03:01 +02:00
stackleak.c	stackleak: add on/off stack variants	2022-05-08 01:33:09 -07:00
stacktrace.c	uaccess: remove CONFIG_SET_FS	2022-02-25 09:36:06 +01:00
static_call_inline.c	static_call: Replace pointless WARN_ON() in static_call_module_notify()	2024-10-17 15:21:29 +02:00
static_call.c	static_call: Don't make __static_call_return0 static	2022-04-05 09:59:38 +02:00
stop_machine.c	Scheduler changes in this cycle were:	2022-05-24 11:11:13 -07:00
sys_ni.c	syscalls: fix compat_sys_io_pgetevents_time64 usage	2024-07-05 09:31:59 +02:00
sys.c	getrusage: use sig->stats_lock rather than lock_task_sighand()	2024-03-15 10:48:22 -04:00
sysctl-test.c	kernel/sysctl-test: use SYSCTL_{ZERO/ONE_HUNDRED} instead of i_{zero/one_hundred}	2022-09-08 16:56:45 -07:00
sysctl.c	proc: proc_skip_spaces() shouldn't think it is working on C strings	2022-12-05 12:09:06 -08:00
task_work.c	task_work: Introduce task_work_cancel() again	2024-08-03 08:49:34 +02:00
taskstats.c	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
torture.c	torture: Fix hang during kthread shutdown phase	2023-03-10 09:34:07 +01:00
tracepoint.c	tracepoint: Optimize the critical region of mutex_lock in tracepoint_module_coming()	2022-09-26 13:01:18 -04:00
tsacct.c	taskstats: version 12 with thread group and exe info	2022-04-29 14:38:03 -07:00
ucount.c	ucounts: Split rlimit and ucount values and max values	2022-05-18 18:24:57 -05:00
uid16.c
uid16.h
umh.c	freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL	2023-02-22 12:59:50 +01:00
up.c
user_namespace.c	ucounts: Split rlimit and ucount values and max values	2022-10-09 16:24:05 -07:00
user-return-notifier.c
user.c
usermode_driver.c	blob_to_mnt(): kern_unmount() is needed to undo kern_mount()	2022-05-19 23:25:47 -04:00
utsname_sysctl.c	kernel/utsname_sysctl.c: Fix hostname polling	2022-10-23 12:01:01 -07:00
utsname.c
watch_queue.c	kernel: watch_queue: copy user-array safely	2023-11-28 17:06:57 +00:00
watchdog_hld.c	watchdog/perf: properly initialize the turbo mode timestamp and rearm counter	2024-08-03 08:49:42 +02:00
watchdog.c	watchdog: move softlockup_panic back to early_param	2023-11-28 17:07:09 +00:00
workqueue_internal.h
workqueue.c	workqueue: Improve scalability of workqueue watchdog touch	2024-09-12 11:10:27 +02:00