linux-kernel - Re: [RFC PATCH] tracing: Fix syscall tracepoint use-after-free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241023220552.74ca0c3e@rorschach.local.home>
Date: Wed, 23 Oct 2024 22:05:52 -0400
From: Steven Rostedt <rostedt@...dmis.org>
To: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
Cc: Alexei Starovoitov <alexei.starovoitov@...il.com>, Jordan Rife
 <jrife@...gle.com>, Arnaldo Carvalho de Melo <acme@...nel.org>, Alexander
 Shishkin <alexander.shishkin@...ux.intel.com>, Andrii Nakryiko
 <andrii.nakryiko@...il.com>, Alexei Starovoitov <ast@...nel.org>, bpf
 <bpf@...r.kernel.org>, Joel Fernandes <joel@...lfernandes.org>, LKML
 <linux-kernel@...r.kernel.org>, Mark Rutland <mark.rutland@....com>, Masami
 Hiramatsu <mhiramat@...nel.org>, Ingo Molnar <mingo@...hat.com>, Michael
 Jeanson <mjeanson@...icios.com>, Namhyung Kim <namhyung@...nel.org>, "Paul
 E. McKenney" <paulmck@...nel.org>, Peter Zijlstra <peterz@...radead.org>,
 syzbot+b390c8062d8387b6272a@...kaller.appspotmail.com, Yonghong Song
 <yhs@...com>
Subject: Re: [RFC PATCH] tracing: Fix syscall tracepoint use-after-free

On Wed, 23 Oct 2024 11:19:40 -0400
Mathieu Desnoyers <mathieu.desnoyers@...icios.com> wrote:
> 
> > Looks like Mathieu patch broke bpf program contract somewhere.  
> 
> My patch series introduced this in the probe:
> 
> #define __BPF_DECLARE_TRACE_SYSCALL(call, proto, args)                  \
> static notrace void                                                     \
> __bpf_trace_##call(void *__data, proto)                                 \
> {                                                                       \
>          might_fault();                                                  \
>          preempt_disable_notrace();                                      \

Is the problem that we can call this function *after* the prog has been
freed? That is, the preempt_disable_notrace() here is meaningless.

Is there a way to add something here to make sure the program is still
valid? Like set a flag in the link structure?

(I don't know how BPF works well enough to know what is involved here,
so excuse me if this is totally off)

-- Steve

>          CONCATENATE(bpf_trace_run, COUNT_ARGS(args))(__data, CAST_TO_U64(args));        \
>          preempt_enable_notrace();                                       \
> }
>