Alexei Starovoitov
18644cec71
bpf: Fix use-after-free in fmod_ret check
Fix the following issue:
[ 436.749342] BUG: KASAN: use-after-free in bpf_trampoline_put+0x39/0x2a0
[ 436.749995] Write of size 4 at addr ffff8881ef38b8a0 by task kworker/3:5/2243
[ 436.750712]
[ 436.752677] Workqueue: events bpf_prog_free_deferred
[ 436.753183] Call Trace:
[ 436.756483] bpf_trampoline_put+0x39/0x2a0
[ 436.756904] bpf_prog_free_deferred+0x16d/0x3d0
[ 436.757377] process_one_work+0x94a/0x15b0
[ 436.761969]
[ 436.762130] Allocated by task 2529:
[ 436.763323] bpf_trampoline_lookup+0x136/0x540
[ 436.763776] bpf_check+0x2872/0xa0a8
[ 436.764144] bpf_prog_load+0xb6f/0x1350
[ 436.764539] __do_sys_bpf+0x16d7/0x3720
[ 436.765825]
[ 436.765988] Freed by task 2529:
[ 436.767084] kfree+0xc6/0x280
[ 436.767397] bpf_trampoline_put+0x1fd/0x2a0
[ 436.767826] bpf_check+0x6832/0xa0a8
[ 436.768197] bpf_prog_load+0xb6f/0x1350
[ 436.768594] __do_sys_bpf+0x16d7/0x3720
prog->aux->trampoline = tr should be set only when prog is valid.
Otherwise prog freeing will try to put trampoline via prog->aux->trampoline,
but it may not point to a valid trampoline.
Fixes: 6ba43b761c ("bpf: Attachment verification for BPF_MODIFY_RETURN")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: KP Singh <kpsingh@google.com>
Link: https://lore.kernel.org/bpf/20200529043839.15824-2-alexei.starovoitov@gmail.com
2020-05-29 22:25:58 +02:00
..
2020-05-29 22:25:58 +02:00
2020-04-03 11:30:20 -07:00
2020-04-07 10:43:42 -07:00
2020-04-03 13:12:26 -07:00
2020-04-08 21:46:57 +02:00
2020-04-22 23:10:14 +02:00
2020-04-10 15:36:22 -07:00
2020-04-14 10:08:50 +02:00
2020-04-08 12:05:07 +02:00
2020-04-27 10:30:30 +02:00
2020-04-10 13:18:57 -07:00
2020-04-14 08:36:41 +02:00
2020-04-22 23:10:13 +02:00
2020-04-16 12:10:54 +02:00
2020-05-15 13:10:06 -07:00
2020-03-25 11:50:48 +01:00
2020-03-23 18:19:06 +01:00
2020-04-06 08:58:42 -07:00
2020-04-20 17:10:58 -04:00
2020-03-12 10:42:51 -04:00
2020-02-22 20:36:47 -05:00
2020-03-12 10:42:51 -04:00
2020-02-21 11:22:15 -08:00
2020-02-04 03:05:26 +00:00
2020-02-14 16:05:04 +01:00
2020-03-30 18:06:39 -07:00
2020-03-25 10:04:01 -05:00
2020-04-24 15:49:00 -05:00
2020-04-07 10:43:42 -07:00
2020-05-08 17:31:50 +02:00
2020-03-30 16:17:15 -07:00
2020-03-21 16:00:24 +01:00
2020-04-07 10:43:44 -07:00
2020-03-25 10:04:01 -05:00
2020-05-07 19:27:20 -07:00
2020-04-10 15:36:22 -07:00
2020-03-20 13:06:20 +01:00
2020-02-04 03:05:26 +00:00
2020-01-31 10:30:41 -08:00
2020-04-09 12:52:34 -07:00
2020-03-21 18:56:06 -07:00
2020-03-06 12:28:24 +11:00
2020-02-28 16:29:12 -06:00
2020-04-10 12:59:56 -07:00
2020-02-04 03:05:26 +00:00
2020-03-31 17:29:33 -07:00
2020-04-23 13:30:18 -07:00
2020-03-25 12:59:37 +01:00
2020-03-21 16:03:54 +01:00
2020-03-03 19:34:32 +01:00
2020-04-02 09:35:31 -07:00
2020-03-02 14:06:33 -07:00
2020-03-30 18:06:39 -07:00
2020-04-07 21:51:27 +02:00
2020-05-15 13:10:06 -07:00
2020-02-07 15:34:12 +01:00
2020-04-08 11:35:20 +02:00