lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 17 Feb 2022 10:30:01 -0800 From: Song Liu <song@...nel.org> To: <bpf@...r.kernel.org>, <netdev@...r.kernel.org> CC: <ast@...nel.org>, <daniel@...earbox.net>, <andrii@...nel.org>, <kernel-team@...com>, Song Liu <song@...nel.org>, <syzbot+2f649ec6d2eea1495a8f@...kaller.appspotmail.com>, <syzbot+ecb1e7e51c52f68f7481@...kaller.appspotmail.com>, <syzbot+87f65c75f4a72db05445@...kaller.appspotmail.com> Subject: [PATCH bpf-next] bpf: bpf_prog_pack: set proper size before freeing ro_header bpf_prog_pack_free() uses header->size to decide whether the header should be freed with module_memfree() or the bpf_prog_pack logic. However, in kvmalloc() failure path of bpf_jit_binary_pack_alloc(), header->size is not set yet. As a result, bpf_prog_pack_free() may treat a slice of a pack as a standalone kvmalloc'd header and call module_memfree() on the whole pack. This in turn causes use-after-free by other users of the pack. Fix this by setting ro_header->size before freeing ro_header. Fixes: 33c9805860e5 ("bpf: Introduce bpf_jit_binary_pack_[alloc|finalize|free]") Reported-by: syzbot+2f649ec6d2eea1495a8f@...kaller.appspotmail.com Reported-by: syzbot+ecb1e7e51c52f68f7481@...kaller.appspotmail.com Reported-by: syzbot+87f65c75f4a72db05445@...kaller.appspotmail.com Signed-off-by: Song Liu <song@...nel.org> --- kernel/bpf/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 44623c9b5bb1..ebb0193d07f0 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -1069,6 +1069,7 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **image_ptr, *rw_header = kvmalloc(size, GFP_KERNEL); if (!*rw_header) { + bpf_arch_text_copy(&ro_header->size, &size, sizeof(size)); bpf_prog_pack_free(ro_header); bpf_jit_uncharge_modmem(size); return NULL; -- 2.30.2
Powered by blists - more mailing lists