linux-kernel - Re: [RFC PATCH v1] tracing: Fix syscall tracepoint use-after-free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f31710d3-e4d8-43ad-9ccb-6d13201756a3@efficios.com>
Date: Fri, 25 Oct 2024 15:38:48 -0400
From: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
To: Jordan Rife <jrife@...gle.com>
Cc: acme@...nel.org, alexander.shishkin@...ux.intel.com,
 andrii.nakryiko@...il.com, ast@...nel.org, bpf@...r.kernel.org,
 joel@...lfernandes.org, linux-kernel@...r.kernel.org, mark.rutland@....com,
 mhiramat@...nel.org, mingo@...hat.com, mjeanson@...icios.com,
 namhyung@...nel.org, paulmck@...nel.org, peterz@...radead.org,
 rostedt@...dmis.org, syzbot+b390c8062d8387b6272a@...kaller.appspotmail.com,
 yhs@...com
Subject: Re: [RFC PATCH v1] tracing: Fix syscall tracepoint use-after-free

On 2024-10-25 15:08, Jordan Rife wrote:
>> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
>> index 59de664e580d..1191dc1d4206 100644
>> --- a/kernel/bpf/syscall.c
>> +++ b/kernel/bpf/syscall.c
>> @@ -3006,14 +3006,21 @@ static void bpf_link_free(struct bpf_link *link)
>>                  bpf_prog_put(link->prog);
> 
> I think we would need the same treatment with bpf_prog_put here.
> Something like,
> 
> tracepoint_call_rcu(raw_tp->btp->tp, &link->prog->aux->rcu,
> 		    bpf_link_defer_bpf_prog_put);
> 
> static void bpf_link_defer_bpf_prog_put(struct rcu_head *rcu)
> {
> 	struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);
> 	bpf_prog_put(aux->prox);
> }

Sure, I'll add this in a v2.

> 
> Alternatively, some context would need to be passed down to
> __bpf_prog_put_noref via the call to bpf_prog_put so it can choose
> whether or not to use call_rcu or call_rcu_tasks_trace.

Also possible, but more cumbersome.

> 
>> -static inline void release_probes(struct tracepoint_func *old)
>> +static bool tracepoint_is_syscall(struct tracepoint *tp)
>> +{
>> +       return !strcmp(tp->name, "sys_enter") || !strcmp(tp->name, "sys_exit");
>> +}
> 
> I'm curious if it might be better to add some field to struct
> tracepoint like "sleepable" rather than adding a special case here
> based on the name? Of course, if it's only ever going to be these
> two cases then maybe adding a new field doesn't make sense.

I know Steven is reluctant to bloat the tracepoint struct because there
are lots of tracepoint instances (thousands). So for now I thought that
just comparing the name would be a good start.

We can eventually go a different route as well: introduce a section just
to put the syscall tracepoints, and compare the struct tracepoint
pointers to the section begin/end range. But it's rather complex
for what should remain a simple fix.

Thanks,

Mathieu


> 
> -Jordan

-- 
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com