Commit e12a5b83 authored May 22, 2024 by Zheng Yejian

kprobes: Fix possible use-after-free issue on kprobe registration

mainline inclusion
from mainline-v6.9-rc4
commit 325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9R2TB

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8

------------------------------------------------------

When unloading a module, its state is changing MODULE_STATE_LIVE ->
 MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take
a time. `is_module_text_address()` and `__module_text_address()`
works with MODULE_STATE_LIVE and MODULE_STATE_GOING.
If we use `is_module_text_address()` and `__module_text_address()`
separately, there is a chance that the first one is succeeded but the
next one is failed because module->state becomes MODULE_STATE_UNFORMED
between those operations.

In `check_kprobe_address_safe()`, if the second `__module_text_address()`
is failed, that is ignored because it expected a kernel_text address.
But it may have failed simply because module->state has been changed
to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify
non-exist module text address (use-after-free).

To fix this problem, we should not use separated `is_module_text_address()`
and `__module_text_address()`, but use only `__module_text_address()`
once and do `try_module_get(module)` which is only available with
MODULE_STATE_LIVE.

Link: https://lore.kernel.org/all/20240410015802.265220-1-zhengyejian1@huawei.com/



Fixes: b983c282 ("kprobes: Forbid probing on trampoline and BPF code areas")
Cc: stable@vger.kernel.org
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
[Resolve conflicts due to lack dependency
commit 223a76b2 ("kprobes: Fix coding style issues")]

parent e280f95c

kernel/kprobes.c

+12 −6

Original line number	Diff line number	Diff line
		@@ -1646,10 +1646,17 @@ static int check_kprobe_address_safe(struct kprobe *p,
		jump_label_lock();
		preempt_disable();

		/* Ensure it is not in reserved area nor out of text */
		if (!(core_kernel_text((unsigned long) p->addr) \|\|
		is_module_text_address((unsigned long) p->addr)) \|\|
		in_gate_area_no_mm((unsigned long) p->addr) \|\|
		/* Ensure the address is in a text area, and find a module if exists. */
		*probed_mod = NULL;
		if (!core_kernel_text((unsigned long) p->addr)) {
		*probed_mod = __module_text_address((unsigned long) p->addr);
		if (!(*probed_mod)) {
		ret = -EINVAL;
		goto out;
		}
		}
		/* Ensure it is not in reserved area. */
		if (in_gate_area_no_mm((unsigned long) p->addr) \|\|
		within_kprobe_blacklist((unsigned long) p->addr) \|\|
		jump_label_text_reserved(p->addr, p->addr) \|\|
		static_call_text_reserved(p->addr, p->addr) \|\|
		@@ -1659,8 +1666,7 @@ static int check_kprobe_address_safe(struct kprobe *p,
		goto out;
		}

		/* Check if are we probing a module */
		*probed_mod = __module_text_address((unsigned long) p->addr);
		/* Get module refcount and reject __init functions for loaded modules. */
		if (*probed_mod) {
		/*
		* We must hold a refcount of the probed module while updating