For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link on tracepoint unregistration
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


A slab-use-after-free is reported by KASAN in __bpf_trace_run /
bpf_trace_run2 when a BPF raw tracepoint link is being torn down
while the tracepoint is concurrently firing on another CPU.

The tracepoint invocation path protects its read side with SRCU
(srcu_read_lock_fast_notrace(&tracepoint_srcu)), but when a BPF raw
tracepoint link is released, bpf_link_free() defers the kfree of the
bpf_raw_tp_link via call_rcu(), which only waits for a regular RCU
grace period. Since regular RCU and SRCU are independent
synchronization domains, call_rcu() does not wait for in-flight SRCU
readers. This means the bpf_raw_tp_link can be freed while a
tracepoint callback is still accessing it, leading to a
use-after-free.

Fix this by calling tracepoint_synchronize_unregister() after
bpf_probe_unregister() in bpf_raw_tp_link_release(). This function
calls synchronize_srcu(&tracepoint_srcu), ensuring all in-flight
tracepoint callbacks have completed before the link enters the
RCU-deferred free path in bpf_link_free().

Reported-by: syzbot+59701a78e84b0bccfe1b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=59701a78e84b0bccfe1b
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 kernel/bpf/syscall.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index dd89bf809772..af6d435dd500 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3782,6 +3782,7 @@ static void bpf_raw_tp_link_release(struct bpf_link *link)
 		container_of(link, struct bpf_raw_tp_link, link);
 
 	bpf_probe_unregister(raw_tp->btp, raw_tp);
+	tracepoint_synchronize_unregister();
 	bpf_put_raw_tracepoint(raw_tp->btp);
 }
 
-- 
2.43.0