linux-kernel - Syzkaller reported fail of bpf_trampoline_unlink

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 3 Apr 2023 20:53:51 +0800
From:   Chen Zhongjin <chenzhongjin@...wei.com>
To:     bpf <bpf@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:     Xu Kuohai <xukuohai@...wei.com>,
        Zhangjinhao <zhangjinhao2@...wei.com>, <ast@...nel.org>,
        <daniel@...earbox.net>, <andrii@...nel.org>,
        <martin.lau@...ux.dev>, <song@...nel.org>, <yhs@...com>,
        <john.fastabend@...il.com>, <kpsingh@...nel.org>, <sdf@...gle.com>,
        <haoluo@...gle.com>, <jolsa@...nel.org>
Subject: Syzkaller reported fail of bpf_trampoline_unlink_prog

Syzkaller reported follow WARNING:

WARNING: CPU: 0 PID: 17072 at bpf_tracing_link_release+0x88/0x90
Modules linked in:
CPU: 0 PID: 17072 Comm: syz-executor.1
RIP: 0010:bpf_tracing_link_release+0x88/0x90
Call Trace:
  bpf_link_free+0x98/0xe0
  bpf_link_put+0xd9/0xf0
  bpf_link_release+0x26/0x30
  __fput+0x219/0x560
  task_work_run+0xbb/0x120
  exit_to_user_mode_prepare+0x12f/0x140
  syscall_exit_to_user_mode+0x23/0x80
  entry_SYSCALL_64_after_hwframe+0x61/0xc6

This is simply caused by fault injection which makes memory allocation fail in
bpf_trampoline_unlink_prog->bpf_trampoline_update
Then bpf_trampoline_unlink_prog returns error and triggers WARN_ON in bpf_tracing_link_relaese.

At first I though it is a false positive report as bpf_trampoline_unlink_prog says
it should never fail. But actually it is possible.
When the bpf_trampoline_update is added at first, there is a "half page" optimization
to promise there is no memory allocation in the unlink path
But 88fd9e5352fe ("bpf: Refactor trampoline update code") added bpf_trampoline_get_progs,
which broke this.
Then the "half page" part was also removed in e21aa341785c ("bpf: Fix fexit trampoline.").
Besides, as I know the relied ftrace interface is not promised to success as well.

In bpf_trampoline_link_prog it will handle these error, but unlink_prog
just reports the warning once and continue to put tr_link->trampoline and link->prog.
Sorry for that I have not fully tested this but I guess this could cause some bad
consequence such as memory leak or null pointer reference.

Anyway, now the interface to detach bpf link is not 100% safe, and because of
the complex logic in bpf_trampoline_update, I think this can't be avoided.
Because now these release ops return void, we cannot just simply keep these resources
and have another try.

I just want to know does anyone has plan or advice to handle these error scenarios gracefully?

Thanks for your help!

Best,
Chen