linux-kernel - Re: [PATCH bpf-next] uprobes: Harden uretprobe syscall trampoline check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202502101459.3B6568A@keescook>
Date: Mon, 10 Feb 2025 15:00:00 -0800
From: Kees Cook <kees@...nel.org>
To: Jiri Olsa <jolsa@...nel.org>
Cc: Steven Rostedt <rostedt@...dmis.org>,
	Masami Hiramatsu <mhiramat@...nel.org>,
	Oleg Nesterov <oleg@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Andrii Nakryiko <andrii@...nel.org>,
	Eyal Birger <eyal.birger@...il.com>, stable@...r.kernel.org,
	Jann Horn <jannh@...gle.com>, linux-kernel@...r.kernel.org,
	linux-trace-kernel@...r.kernel.org, linux-api@...r.kernel.org,
	x86@...nel.org, bpf@...r.kernel.org,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, Andy Lutomirski <luto@...nel.org>,
	Deepak Gupta <debug@...osinc.com>,
	Stephen Rothwell <sfr@...b.auug.org.au>
Subject: Re: [PATCH bpf-next] uprobes: Harden uretprobe syscall trampoline
 check

On Sun, Feb 09, 2025 at 11:05:15PM +0100, Jiri Olsa wrote:
> Jann reported [1] possible issue when trampoline_check_ip returns
> address near the bottom of the address space that is allowed to
> call into the syscall if uretprobes are not set up.
> 
> Though the mmap minimum address restrictions will typically prevent
> creating mappings there, let's make sure uretprobe syscall checks
> for that.
> 
> [1] https://lore.kernel.org/bpf/202502081235.5A6F352985@keescook/T/#m9d416df341b8fbc11737dacbcd29f0054413cbbf
> Cc: Kees Cook <kees@...nel.org>
> Cc: Eyal Birger <eyal.birger@...il.com>
> Cc: stable@...r.kernel.org
> Reported-by: Jann Horn <jannh@...gle.com>
> Signed-off-by: Jiri Olsa <jolsa@...nel.org>

Thanks for this!

Reviewed-by: Kees Cook <kees@...nel.org>

-- 
Kees Cook