Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpf: Fix KASAN use-after-free Read in compute_effective_progs #3012

Closed
wants to merge 2 commits into from
Closed

bpf: Fix KASAN use-after-free Read in compute_effective_progs #3012

wants to merge 2 commits into from

Conversation

kernel-patches-bot
Copy link

Pull request for series with
subject: bpf: Fix KASAN use-after-free Read in compute_effective_progs
version: 3
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=641542

@kernel-patches-bot
Copy link
Author

Master branch: b2531d4
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=641542
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 0d2d264
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=641542
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 0d2d264
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=641542
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 16d1e00
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=641542
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 418fbe8
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=641542
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 418fbe8
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=641542
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: ac6a658
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=641542
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 68084a1
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=641542
version: 3

@kernel-patches-bot
Copy link
Author

At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=641542 expired. Closing PR.

@kernel-patches-bot
Copy link
Author

Master branch: 68084a1
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=642452
version: 4

@kernel-patches-bot
Copy link
Author

Master branch: 70a1b25
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=642452
version: 4

@kernel-patches-bot
Copy link
Author

Master branch: 4050764
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=642452
version: 4

@kernel-patches-bot
Copy link
Author

Master branch: f9a3eca
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=642452
version: 4

@kernel-patches-bot
Copy link
Author

Master branch: fe73656
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=642452
version: 4

@kernel-patches-bot
Copy link
Author

Master branch: 1ec5ee8
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=642452
version: 4

@kernel-patches-bot
Copy link
Author

Master branch: 608b638
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=642452
version: 4

@kernel-patches-bot
Copy link
Author

Master branch: 677fb75
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=642452
version: 4

@kernel-patches-bot
Copy link
Author

Master branch: 7e062cd
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=642452
version: 4

@kernel-patches-bot
Copy link
Author

Master branch: 7e062cd
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=642452
version: 4

@kernel-patches-bot
Copy link
Author

Master branch: 1626f57
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=642452
version: 4

Kernel Patches Daemon and others added 2 commits May 30, 2022 13:58
adding ci files
01a925a
@tstruk
bpf: Fix KASAN use-after-free Read in compute_effective_progs
d2fa67f 
Syzbot found a Use After Free bug in compute_effective_progs().
The reproducer creates a number of BPF links, and causes a fault
injected alloc to fail, while calling bpf_link_detach on them.
Link detach triggers the link to be freed by bpf_link_free(),
which calls __cgroup_bpf_detach() and update_effective_progs().
If the memory allocation in this function fails, the function restores
the pointer to the bpf_cgroup_link on the cgroup list, but the memory
gets freed just after it returns. After this, every subsequent call to
update_effective_progs() causes this already deallocated pointer to be
dereferenced in prog_list_length(), and triggers KASAN UAF error.

To fix this issue don't preserve the pointer to the prog or link in the
list, but remove it and replace it with a dummy prog without shrinking
the table. The subsequent call to __cgroup_bpf_detach() or
__cgroup_bpf_detach() will correct it.

Cc: "Alexei Starovoitov" <ast@kernel.org>
Cc: "Daniel Borkmann" <daniel@iogearbox.net>
Cc: "Andrii Nakryiko" <andrii@kernel.org>
Cc: "Martin KaFai Lau" <kafai@fb.com>
Cc: "Song Liu" <songliubraving@fb.com>
Cc: "Yonghong Song" <yhs@fb.com>
Cc: "John Fastabend" <john.fastabend@gmail.com>
Cc: "KP Singh" <kpsingh@kernel.org>
Cc: <netdev@vger.kernel.org>
Cc: <bpf@vger.kernel.org>
Cc: <stable@vger.kernel.org>
Cc: <linux-kernel@vger.kernel.org>

Link: https://syzkaller.appspot.com/bug?id=8ebf179a95c2a2670f7cf1ba62429ec044369db4
Fixes: af6eea5 ("bpf: Implement bpf_link-based cgroup BPF program attachment")
Reported-by: <syzbot+f264bffdfbd5614f3bb2@syzkaller.appspotmail.com>
Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
@kernel-patches-bot
Copy link
Author

Master branch: 4b4b4f9
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=642452
version: 4

@kernel-patches-bot
Copy link
Author

At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=641542 irrelevant now. Closing PR.

@kernel-patches-bot kernel-patches-bot deleted the series/629219=>bpf-next branch May 31, 2022 18:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
bpf-next superseded V3
Projects
None yet
Milestone
No milestone
2 participants
@kernel-patches-bot @tstruk