* [PATCH bpf] bpf: fix missing prog untrack in release_maps
@ 2019-12-16 16:49 Daniel Borkmann
2019-12-16 18:52 ` Yonghong Song
0 siblings, 1 reply; 3+ messages in thread
From: Daniel Borkmann @ 2019-12-16 16:49 UTC (permalink / raw)
To: alexei.starovoitov; +Cc: netdev, bpf, Daniel Borkmann
Commit da765a2f5993 ("bpf: Add poke dependency tracking for prog array
maps") wrongly assumed that in case of prog load errors, we're cleaning
up all program tracking via bpf_free_used_maps().
However, it can happen that we're still at the point where we didn't copy
map pointers into the prog's aux section such that env->prog->aux->used_maps
is still zero, running into a UAF. In such case, the verifier has similar
release_maps() helper that drops references to used maps from its env.
Consolidate the release code into __bpf_free_used_maps() and call it from
all sides to fix it.
Fixes: da765a2f5993 ("bpf: Add poke dependency tracking for prog array maps")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
include/linux/bpf.h | 2 ++
kernel/bpf/core.c | 14 ++++++++++----
kernel/bpf/verifier.c | 14 ++------------
3 files changed, 14 insertions(+), 16 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index ac7de5291509..085a59afba85 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -818,6 +818,8 @@ struct bpf_prog * __must_check bpf_prog_inc_not_zero(struct bpf_prog *prog);
void bpf_prog_put(struct bpf_prog *prog);
int __bpf_prog_charge(struct user_struct *user, u32 pages);
void __bpf_prog_uncharge(struct user_struct *user, u32 pages);
+void __bpf_free_used_maps(struct bpf_prog_aux *aux,
+ struct bpf_map **used_maps, u32 len);
void bpf_prog_free_id(struct bpf_prog *prog, bool do_idr_lock);
void bpf_map_free_id(struct bpf_map *map, bool do_idr_lock);
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 49e32acad7d8..6231858df723 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2048,18 +2048,24 @@ static void bpf_free_cgroup_storage(struct bpf_prog_aux *aux)
}
}
-static void bpf_free_used_maps(struct bpf_prog_aux *aux)
+void __bpf_free_used_maps(struct bpf_prog_aux *aux,
+ struct bpf_map **used_maps, u32 len)
{
struct bpf_map *map;
- int i;
+ u32 i;
bpf_free_cgroup_storage(aux);
- for (i = 0; i < aux->used_map_cnt; i++) {
- map = aux->used_maps[i];
+ for (i = 0; i < len; i++) {
+ map = used_maps[i];
if (map->ops->map_poke_untrack)
map->ops->map_poke_untrack(map, aux);
bpf_map_put(map);
}
+}
+
+static void bpf_free_used_maps(struct bpf_prog_aux *aux)
+{
+ __bpf_free_used_maps(aux, aux->used_maps, aux->used_map_cnt);
kfree(aux->used_maps);
}
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 034ef81f935b..a1acdce77070 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -8298,18 +8298,8 @@ static int replace_map_fd_with_map_ptr(struct bpf_verifier_env *env)
/* drop refcnt of maps used by the rejected program */
static void release_maps(struct bpf_verifier_env *env)
{
- enum bpf_cgroup_storage_type stype;
- int i;
-
- for_each_cgroup_storage_type(stype) {
- if (!env->prog->aux->cgroup_storage[stype])
- continue;
- bpf_cgroup_storage_release(env->prog,
- env->prog->aux->cgroup_storage[stype]);
- }
-
- for (i = 0; i < env->used_map_cnt; i++)
- bpf_map_put(env->used_maps[i]);
+ __bpf_free_used_maps(env->prog->aux, env->used_maps,
+ env->used_map_cnt);
}
/* convert pseudo BPF_LD_IMM64 into generic BPF_LD_IMM64 */
--
2.21.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH bpf] bpf: fix missing prog untrack in release_maps
2019-12-16 16:49 [PATCH bpf] bpf: fix missing prog untrack in release_maps Daniel Borkmann
@ 2019-12-16 18:52 ` Yonghong Song
2019-12-16 20:33 ` Alexei Starovoitov
0 siblings, 1 reply; 3+ messages in thread
From: Yonghong Song @ 2019-12-16 18:52 UTC (permalink / raw)
To: Daniel Borkmann, alexei.starovoitov; +Cc: netdev, bpf
On 12/16/19 8:49 AM, Daniel Borkmann wrote:
> Commit da765a2f5993 ("bpf: Add poke dependency tracking for prog array
> maps") wrongly assumed that in case of prog load errors, we're cleaning
> up all program tracking via bpf_free_used_maps().
>
> However, it can happen that we're still at the point where we didn't copy
> map pointers into the prog's aux section such that env->prog->aux->used_maps
> is still zero, running into a UAF. In such case, the verifier has similar
> release_maps() helper that drops references to used maps from its env.
>
> Consolidate the release code into __bpf_free_used_maps() and call it from
> all sides to fix it.
>
> Fixes: da765a2f5993 ("bpf: Add poke dependency tracking for prog array maps")
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH bpf] bpf: fix missing prog untrack in release_maps
2019-12-16 18:52 ` Yonghong Song
@ 2019-12-16 20:33 ` Alexei Starovoitov
0 siblings, 0 replies; 3+ messages in thread
From: Alexei Starovoitov @ 2019-12-16 20:33 UTC (permalink / raw)
To: Yonghong Song; +Cc: Daniel Borkmann, netdev, bpf
On Mon, Dec 16, 2019 at 10:52 AM Yonghong Song <yhs@fb.com> wrote:
>
>
>
> On 12/16/19 8:49 AM, Daniel Borkmann wrote:
> > Commit da765a2f5993 ("bpf: Add poke dependency tracking for prog array
> > maps") wrongly assumed that in case of prog load errors, we're cleaning
> > up all program tracking via bpf_free_used_maps().
> >
> > However, it can happen that we're still at the point where we didn't copy
> > map pointers into the prog's aux section such that env->prog->aux->used_maps
> > is still zero, running into a UAF. In such case, the verifier has similar
> > release_maps() helper that drops references to used maps from its env.
> >
> > Consolidate the release code into __bpf_free_used_maps() and call it from
> > all sides to fix it.
> >
> > Fixes: da765a2f5993 ("bpf: Add poke dependency tracking for prog array maps")
> > Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
>
> Acked-by: Yonghong Song <yhs@fb.com>
Applied. Thanks
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-12-16 20:33 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-12-16 16:49 [PATCH bpf] bpf: fix missing prog untrack in release_maps Daniel Borkmann
2019-12-16 18:52 ` Yonghong Song
2019-12-16 20:33 ` Alexei Starovoitov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).