Commit a2ea0746 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Alexei Starovoitov
Browse files

bpf: Fix missing prog untrack in release_maps 



Commit da765a2f ("bpf: Add poke dependency tracking for prog array
maps") wrongly assumed that in case of prog load errors, we're cleaning
up all program tracking via bpf_free_used_maps().

However, it can happen that we're still at the point where we didn't copy
map pointers into the prog's aux section such that env->prog->aux->used_maps
is still zero, running into a UAF. In such case, the verifier has similar
release_maps() helper that drops references to used maps from its env.

Consolidate the release code into __bpf_free_used_maps() and call it from
all sides to fix it.

Fixes: da765a2f ("bpf: Add poke dependency tracking for prog array maps")
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarYonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/1c2909484ca524ae9f55109b06f22b6213e76376.1576514756.git.daniel@iogearbox.net
parent 5133498f

include/linux/bpf.h

+2 −0
Original line number Diff line number Diff line
@@ -818,6 +818,8 @@ struct bpf_prog * __must_check bpf_prog_inc_not_zero(struct bpf_prog *prog); 
void bpf_prog_put(struct bpf_prog *prog);

int __bpf_prog_charge(struct user_struct *user, u32 pages);

void __bpf_prog_uncharge(struct user_struct *user, u32 pages);

void __bpf_free_used_maps(struct bpf_prog_aux *aux,

			  struct bpf_map **used_maps, u32 len);



void bpf_prog_free_id(struct bpf_prog *prog, bool do_idr_lock);

void bpf_map_free_id(struct bpf_map *map, bool do_idr_lock);

kernel/bpf/core.c

+10 −4
Original line number Diff line number Diff line
@@ -2048,18 +2048,24 @@ static void bpf_free_cgroup_storage(struct bpf_prog_aux *aux) 
	}

}



static void bpf_free_used_maps(struct bpf_prog_aux *aux)

void __bpf_free_used_maps(struct bpf_prog_aux *aux,

			  struct bpf_map **used_maps, u32 len)

{

	struct bpf_map *map;

	int i;

	u32 i;



	bpf_free_cgroup_storage(aux);

	for (i = 0; i < aux->used_map_cnt; i++) {

		map = aux->used_maps[i];

	for (i = 0; i < len; i++) {

		map = used_maps[i];

		if (map->ops->map_poke_untrack)

			map->ops->map_poke_untrack(map, aux);

		bpf_map_put(map);

	}

}



static void bpf_free_used_maps(struct bpf_prog_aux *aux)

{

	__bpf_free_used_maps(aux, aux->used_maps, aux->used_map_cnt);

	kfree(aux->used_maps);

}

kernel/bpf/verifier.c

+2 −12
Original line number Diff line number Diff line
@@ -8298,18 +8298,8 @@ next_insn: 
/* drop refcnt of maps used by the rejected program */

static void release_maps(struct bpf_verifier_env *env)

{

	enum bpf_cgroup_storage_type stype;

	int i;



	for_each_cgroup_storage_type(stype) {

		if (!env->prog->aux->cgroup_storage[stype])

			continue;

		bpf_cgroup_storage_release(env->prog,

			env->prog->aux->cgroup_storage[stype]);

	}



	for (i = 0; i < env->used_map_cnt; i++)

		bpf_map_put(env->used_maps[i]);

	__bpf_free_used_maps(env->prog->aux, env->used_maps,

			     env->used_map_cnt);

}



/* convert pseudo BPF_LD_IMM64 into generic BPF_LD_IMM64 */

CRA Git | Maintained and supported by SUSTech CRA and CCSE