linux-kernel - [PATCH stable 5.15] lib/buildid: Handle memfd_secret() files in build_id

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <E2C3ADFDB3DFD774+20250314090400.31676-2-chenlinxuan@deepin.org>
Date: Fri, 14 Mar 2025 17:04:00 +0800
From: Chen Linxuan <chenlinxuan@...pin.org>
To: Andrii Nakryiko <andrii@...nel.org>,
	Sasha Levin <sashal@...nel.org>,
	Jiri Olsa <jolsa@...nel.org>,
	Chen Linxuan <chenlinxuan@...pin.org>,
	Alexey Dobriyan <adobriyan@...il.com>,
	Alexei Starovoitov <ast@...nel.org>,
	Shakeel Butt <shakeel.butt@...ux.dev>,
	Eduard Zingerman <eddyz87@...il.com>,
	"Peter Zijlstra (Intel)" <peterz@...radead.org>
Cc: Yi Lai <yi1.lai@...el.com>,
	Daniel Borkmann <daniel@...earbox.net>,
	stable@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	Jann Horn <jannh@...gle.com>,
	linux-kernel@...r.kernel.org,
	bpf@...r.kernel.org
Subject: [PATCH stable 5.15] lib/buildid: Handle memfd_secret() files in build_id_parse()

[ Upstream commit 5ac9b4e935dfc6af41eee2ddc21deb5c36507a9f ]

>>From memfd_secret(2) manpage:

  The memory areas backing the file created with memfd_secret(2) are
  visible only to the processes that have access to the file descriptor.
  The memory region is removed from the kernel page tables and only the
  page tables of the processes holding the file descriptor map the
  corresponding physical memory. (Thus, the pages in the region can't be
  accessed by the kernel itself, so that, for example, pointers to the
  region can't be passed to system calls.)

We need to handle this special case gracefully in build ID fetching
code. Return -EFAULT whenever secretmem file is passed to build_id_parse()
family of APIs. Original report and repro can be found in [0].

  [0] https://lore.kernel.org/bpf/ZwyG8Uro%2FSyTXAni@ly-workstation/

Fixes: de3ec364c3c3 ("lib/buildid: add single folio-based file reader abstraction")
Reported-by: Yi Lai <yi1.lai@...el.com>
Suggested-by: Shakeel Butt <shakeel.butt@...ux.dev>
Signed-off-by: Andrii Nakryiko <andrii@...nel.org>
Signed-off-by: Daniel Borkmann <daniel@...earbox.net>
Acked-by: Shakeel Butt <shakeel.butt@...ux.dev>
Link: https://lore.kernel.org/bpf/20241017175431.6183-A-hca@linux.ibm.com
Link: https://lore.kernel.org/bpf/20241017174713.2157873-1-andrii@kernel.org
[ Linxuan: perform an equivalent direct check without folio-based changes ]
Cc: stable@...r.kernel.org
Fixes: 88a16a130933 ("perf: Add build id data in mmap2 event")
Signed-off-by: Chen Linxuan <chenlinxuan@...pin.org>
---

Some previous discussions can be found in the following links:
https://lore.kernel.org/stable/05D0A9F7DE394601+20250311100555.310788-2-chenlinxuan@deepin.org/

---
 lib/buildid.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/buildid.c b/lib/buildid.c
index 9fc46366597e..6249bd47fb0b 100644
--- a/lib/buildid.c
+++ b/lib/buildid.c
@@ -5,6 +5,7 @@
 #include <linux/elf.h>
 #include <linux/kernel.h>
 #include <linux/pagemap.h>
+#include <linux/secretmem.h>
 
 #define BUILD_ID 3
 
@@ -157,6 +158,12 @@ int build_id_parse(struct vm_area_struct *vma, unsigned char *build_id,
 	if (!vma->vm_file)
 		return -EINVAL;
 
+#ifdef CONFIG_SECRETMEM
+       /* reject secretmem folios created with memfd_secret() */
+       if (vma->vm_file->f_mapping->a_ops == &secretmem_aops)
+               return -EFAULT;
+#endif
+
 	page = find_get_page(vma->vm_file->f_mapping, 0);
 	if (!page)
 		return -EFAULT;	/* page not mapped */
-- 
2.48.1