From nobody Sun Dec 14 06:17:09 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3FD34C00140 for ; Mon, 15 Aug 2022 18:21:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240352AbiHOSVK (ORCPT ); Mon, 15 Aug 2022 14:21:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40566 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240251AbiHOST1 (ORCPT ); Mon, 15 Aug 2022 14:19:27 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 94F922BB3D; Mon, 15 Aug 2022 11:16:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id AFCFACE125C; Mon, 15 Aug 2022 18:16:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BBC23C433D7; Mon, 15 Aug 2022 18:16:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1660587386; bh=YliFvWsr8oWemC+G3mB9eCvhmTIWlPM+9ElUyDZ1OBA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2gjf4K6tT8bKP6eCWiKjBr7DyfGVs+oQMS4KzaCx9gXQ+5L7RPn1kfzskqQ5YhJWl MxdAebUY8rFIDy3E8Dkh0gd48Oth3It9N5Wyzxjc1rIOBLT+G0rtR3FLAkSF5iOmKf TA0Q2rCoQNAeRrOr90sXlWdJI/Zay1XXoKbW6g/g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+f264bffdfbd5614f3bb2@syzkaller.appspotmail.com, Tadeusz Struk , Andrii Nakryiko Subject: [PATCH 5.15 070/779] bpf: Fix KASAN use-after-free Read in compute_effective_progs Date: Mon, 15 Aug 2022 19:55:14 +0200 Message-Id: <20220815180340.281807316@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220815180337.130757997@linuxfoundation.org> References: <20220815180337.130757997@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tadeusz Struk commit 4c46091ee985ae84c60c5e95055d779fcd291d87 upstream. Syzbot found a Use After Free bug in compute_effective_progs(). The reproducer creates a number of BPF links, and causes a fault injected alloc to fail, while calling bpf_link_detach on them. Link detach triggers the link to be freed by bpf_link_free(), which calls __cgroup_bpf_detach() and update_effective_progs(). If the memory allocation in this function fails, the function restores the pointer to the bpf_cgroup_link on the cgroup list, but the memory gets freed just after it returns. After this, every subsequent call to update_effective_progs() causes this already deallocated pointer to be dereferenced in prog_list_length(), and triggers KASAN UAF error. To fix this issue don't preserve the pointer to the prog or link in the list, but remove it and replace it with a dummy prog without shrinking the table. The subsequent call to __cgroup_bpf_detach() or __cgroup_bpf_detach() will correct it. Fixes: af6eea57437a ("bpf: Implement bpf_link-based cgroup BPF program atta= chment") Reported-by: Signed-off-by: Tadeusz Struk Signed-off-by: Andrii Nakryiko Cc: Link: https://syzkaller.appspot.com/bug?id=3D8ebf179a95c2a2670f7cf1ba62429e= c044369db4 Link: https://lore.kernel.org/bpf/20220517180420.87954-1-tadeusz.struk@lina= ro.org Signed-off-by: Greg Kroah-Hartman --- kernel/bpf/cgroup.c | 70 ++++++++++++++++++++++++++++++++++++++++++++---= ----- 1 file changed, 60 insertions(+), 10 deletions(-) --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -668,6 +668,60 @@ static struct bpf_prog_list *find_detach } =20 /** + * purge_effective_progs() - After compute_effective_progs fails to alloc = new + * cgrp->bpf.inactive table we can recover by + * recomputing the array in place. + * + * @cgrp: The cgroup which descendants to travers + * @prog: A program to detach or NULL + * @link: A link to detach or NULL + * @atype: Type of detach operation + */ +static void purge_effective_progs(struct cgroup *cgrp, struct bpf_prog *pr= og, + struct bpf_cgroup_link *link, + enum cgroup_bpf_attach_type atype) +{ + struct cgroup_subsys_state *css; + struct bpf_prog_array *progs; + struct bpf_prog_list *pl; + struct list_head *head; + struct cgroup *cg; + int pos; + + /* recompute effective prog array in place */ + css_for_each_descendant_pre(css, &cgrp->self) { + struct cgroup *desc =3D container_of(css, struct cgroup, self); + + if (percpu_ref_is_zero(&desc->bpf.refcnt)) + continue; + + /* find position of link or prog in effective progs array */ + for (pos =3D 0, cg =3D desc; cg; cg =3D cgroup_parent(cg)) { + if (pos && !(cg->bpf.flags[atype] & BPF_F_ALLOW_MULTI)) + continue; + + head =3D &cg->bpf.progs[atype]; + list_for_each_entry(pl, head, node) { + if (!prog_list_prog(pl)) + continue; + if (pl->prog =3D=3D prog && pl->link =3D=3D link) + goto found; + pos++; + } + } +found: + BUG_ON(!cg); + progs =3D rcu_dereference_protected( + desc->bpf.effective[atype], + lockdep_is_held(&cgroup_mutex)); + + /* Remove the program from the array */ + WARN_ONCE(bpf_prog_array_delete_safe_at(progs, pos), + "Failed to purge a prog from array at index %d", pos); + } +} + +/** * __cgroup_bpf_detach() - Detach the program or link from a cgroup, and * propagate the change to descendants * @cgrp: The cgroup which descendants to traverse @@ -686,7 +740,6 @@ int __cgroup_bpf_detach(struct cgroup *c struct bpf_prog_list *pl; struct list_head *progs; u32 flags; - int err; =20 atype =3D to_cgroup_bpf_attach_type(type); if (atype < 0) @@ -708,9 +761,12 @@ int __cgroup_bpf_detach(struct cgroup *c pl->prog =3D NULL; pl->link =3D NULL; =20 - err =3D update_effective_progs(cgrp, atype); - if (err) - goto cleanup; + if (update_effective_progs(cgrp, atype)) { + /* if update effective array failed replace the prog with a dummy prog*/ + pl->prog =3D old_prog; + pl->link =3D link; + purge_effective_progs(cgrp, old_prog, link, atype); + } =20 /* now can actually delete it from this cgroup list */ list_del(&pl->node); @@ -722,12 +778,6 @@ int __cgroup_bpf_detach(struct cgroup *c bpf_prog_put(old_prog); static_branch_dec(&cgroup_bpf_enabled_key[atype]); return 0; - -cleanup: - /* restore back prog or link */ - pl->prog =3D old_prog; - pl->link =3D link; - return err; } =20 /* Must be called with cgroup_mutex held to avoid races. */