Unverified Commit ac4ff86e authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14901 Fix CVE-2024-47794 

Merge Pull Request from: @ci-robot 
 
PR sync from: Tengda Wu <wutengda2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/V6LS5Y6Y42VUVUYYKE2XTLNRVVMNVMKR/ 
Fix CVE-2024-47794.

Leon Hwang (3):
  bpf: Prevent tailcall infinite loop caused by freplace
  selftests/bpf: Add testcase for updating attached freplace prog to
    prog_array map
  selftests/bpf: Add test to verify tailcall and freplace restrictions

Tengda Wu (1):
  bpf: Fix kabi breakage in struct bpf_prog_aux


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IBIADD 
 
Link:https://gitee.com/openeuler/kernel/pulls/14901

 

Reviewed-by: default avatarYe Weihua <yeweihua4@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 559a0276 87db4635

include/linux/bpf.h

+16 −5
Original line number Diff line number Diff line
@@ -1292,8 +1292,12 @@ int bpf_dynptr_check_size(u32 size); 
u32 __bpf_dynptr_size(const struct bpf_dynptr_kern *ptr);



#ifdef CONFIG_BPF_JIT

int bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr);

int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr);

int bpf_trampoline_link_prog(struct bpf_tramp_link *link,

			     struct bpf_trampoline *tr,

			     struct bpf_prog *tgt_prog);

int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,

			       struct bpf_trampoline *tr,

			       struct bpf_prog *tgt_prog);

struct bpf_trampoline *bpf_trampoline_get(u64 key,

					  struct bpf_attach_target_info *tgt_info);

void bpf_trampoline_put(struct bpf_trampoline *tr);
@@ -1374,12 +1378,14 @@ void bpf_jit_uncharge_modmem(u32 size); 
bool bpf_prog_has_trampoline(const struct bpf_prog *prog);

#else

static inline int bpf_trampoline_link_prog(struct bpf_tramp_link *link,

					   struct bpf_trampoline *tr)

					   struct bpf_trampoline *tr,

					   struct bpf_prog *tgt_prog)

{

	return -ENOTSUPP;

}

static inline int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,

					     struct bpf_trampoline *tr)

					     struct bpf_trampoline *tr,

					     struct bpf_prog *tgt_prog)

{

	return -ENOTSUPP;

}
@@ -1462,6 +1468,7 @@ struct bpf_prog_aux { 
	u32 ctx_arg_info_size;

	u32 max_rdonly_access;

	u32 max_rdwr_access;

	KABI_FILL_HOLE(bool is_extended) /* true if extended by freplace program */

	struct btf *attach_btf;

	const struct bpf_ctx_arg_aux *ctx_arg_info;

	struct mutex dst_mutex; /* protects dst_* pointers below, *after* prog becomes visible */
@@ -1536,11 +1543,15 @@ struct bpf_prog_aux { 
		struct rcu_head	rcu;

	};



	KABI_RESERVE(1)

	KABI_USE(1, u64 prog_array_member_cnt) /* counts how many times as member of prog_array */

#ifdef __GENKSYMS__

	KABI_RESERVE(2)

	KABI_RESERVE(3)

	KABI_RESERVE(4)

	KABI_RESERVE(5)

#else

	struct mutex ext_mutex; /* mutex for is_extended and prog_array_member_cnt */

#endif

	KABI_RESERVE(6)

	KABI_RESERVE(7)

	KABI_RESERVE(8)

kernel/bpf/arraymap.c

+24 −2
Original line number Diff line number Diff line
@@ -909,22 +909,44 @@ static void *prog_fd_array_get_ptr(struct bpf_map *map, 
				   struct file *map_file, int fd)

{

	struct bpf_prog *prog = bpf_prog_get(fd);

	bool is_extended;



	if (IS_ERR(prog))

		return prog;



	if (!bpf_prog_map_compatible(map, prog)) {

	if (prog->type == BPF_PROG_TYPE_EXT ||

	    !bpf_prog_map_compatible(map, prog)) {

		bpf_prog_put(prog);

		return ERR_PTR(-EINVAL);

	}



	mutex_lock(&prog->aux->ext_mutex);

	is_extended = prog->aux->is_extended;

	if (!is_extended)

		prog->aux->prog_array_member_cnt++;

	mutex_unlock(&prog->aux->ext_mutex);

	if (is_extended) {

		/* Extended prog can not be tail callee. It's to prevent a

		 * potential infinite loop like:

		 * tail callee prog entry -> tail callee prog subprog ->

		 * freplace prog entry --tailcall-> tail callee prog entry.

		 */

		bpf_prog_put(prog);

		return ERR_PTR(-EBUSY);

	}



	return prog;

}



static void prog_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)

{

	struct bpf_prog *prog = ptr;



	mutex_lock(&prog->aux->ext_mutex);

	prog->aux->prog_array_member_cnt--;

	mutex_unlock(&prog->aux->ext_mutex);

	/* bpf_prog is freed after one RCU or tasks trace grace period */

	bpf_prog_put(ptr);

	bpf_prog_put(prog);

}



static u32 prog_fd_array_sys_lookup_elem(void *ptr)

kernel/bpf/core.c

+1 −0
Original line number Diff line number Diff line
@@ -122,6 +122,7 @@ struct bpf_prog *bpf_prog_alloc_no_stats(unsigned int size, gfp_t gfp_extra_flag 


	INIT_LIST_HEAD_RCU(&fp->aux->ksym.lnode);

	mutex_init(&fp->aux->used_maps_mutex);

	mutex_init(&fp->aux->ext_mutex);

	mutex_init(&fp->aux->dst_mutex);



	return fp;

kernel/bpf/syscall.c

+4 −3
Original line number Diff line number Diff line
@@ -3119,7 +3119,8 @@ static void bpf_tracing_link_release(struct bpf_link *link) 
#endif



	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&tr_link->link,

						tr_link->trampoline));

						tr_link->trampoline,

						tr_link->tgt_prog));



	bpf_trampoline_put(tr_link->trampoline);
@@ -3337,7 +3338,7 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, 
	if (err)

		goto out_unlock;



	err = bpf_trampoline_link_prog(&link->link, tr);

	err = bpf_trampoline_link_prog(&link->link, tr, tgt_prog);

	if (err) {

		bpf_link_cleanup(&link_primer);

		link = NULL;

kernel/bpf/trampoline.c

+39 −8
Original line number Diff line number Diff line
@@ -513,7 +513,27 @@ static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog) 
	}

}



static int __bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr)

static int bpf_freplace_check_tgt_prog(struct bpf_prog *tgt_prog)

{

	struct bpf_prog_aux *aux = tgt_prog->aux;



	guard(mutex)(&aux->ext_mutex);

	if (aux->prog_array_member_cnt)

		/* Program extensions can not extend target prog when the target

		 * prog has been updated to any prog_array map as tail callee.

		 * It's to prevent a potential infinite loop like:

		 * tgt prog entry -> tgt prog subprog -> freplace prog entry

		 * --tailcall-> tgt prog entry.

		 */

		return -EBUSY;



	aux->is_extended = true;

	return 0;

}



static int __bpf_trampoline_link_prog(struct bpf_tramp_link *link,

				      struct bpf_trampoline *tr,

				      struct bpf_prog *tgt_prog)

{

	enum bpf_tramp_prog_type kind;

	struct bpf_tramp_link *link_exiting;
@@ -534,6 +554,9 @@ static int __bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_tr 
		/* Cannot attach extension if fentry/fexit are in use. */

		if (cnt)

			return -EBUSY;

		err = bpf_freplace_check_tgt_prog(tgt_prog);

		if (err)

			return err;

		tr->extension_prog = link->link.prog;

		return bpf_arch_text_poke(tr->func.addr, BPF_MOD_JUMP, NULL,

					  link->link.prog->bpf_func);
@@ -560,17 +583,21 @@ static int __bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_tr 
	return err;

}



int bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr)

int bpf_trampoline_link_prog(struct bpf_tramp_link *link,

			     struct bpf_trampoline *tr,

			     struct bpf_prog *tgt_prog)

{

	int err;



	mutex_lock(&tr->mutex);

	err = __bpf_trampoline_link_prog(link, tr);

	err = __bpf_trampoline_link_prog(link, tr, tgt_prog);

	mutex_unlock(&tr->mutex);

	return err;

}



static int __bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr)

static int __bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,

					struct bpf_trampoline *tr,

					struct bpf_prog *tgt_prog)

{

	enum bpf_tramp_prog_type kind;

	int err;
@@ -581,6 +608,8 @@ static int __bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_ 
		err = bpf_arch_text_poke(tr->func.addr, BPF_MOD_JUMP,

					 tr->extension_prog->bpf_func, NULL);

		tr->extension_prog = NULL;

		guard(mutex)(&tgt_prog->aux->ext_mutex);

		tgt_prog->aux->is_extended = false;

		return err;

	}

	hlist_del_init(&link->tramp_hlist);
@@ -589,12 +618,14 @@ static int __bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_ 
}



/* bpf_trampoline_unlink_prog() should never fail. */

int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr)

int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,

			       struct bpf_trampoline *tr,

			       struct bpf_prog *tgt_prog)

{

	int err;



	mutex_lock(&tr->mutex);

	err = __bpf_trampoline_unlink_prog(link, tr);

	err = __bpf_trampoline_unlink_prog(link, tr, tgt_prog);

	mutex_unlock(&tr->mutex);

	return err;

}
@@ -609,7 +640,7 @@ static void bpf_shim_tramp_link_release(struct bpf_link *link) 
	if (!shim_link->trampoline)

		return;



	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link, shim_link->trampoline));

	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link, shim_link->trampoline, NULL));

	bpf_trampoline_put(shim_link->trampoline);

}
@@ -723,7 +754,7 @@ int bpf_trampoline_link_cgroup_shim(struct bpf_prog *prog, 
		goto err;

	}



	err = __bpf_trampoline_link_prog(&shim_link->link, tr);

	err = __bpf_trampoline_link_prog(&shim_link->link, tr, NULL);

	if (err)

		goto err;