bpf: Fail bpf_probe_write_user() while mm is switched (c7b6f29b) · Commits · 戴 / test

When using a temporary mm, bpf_probe_write_user() should not be able to write to user memory, since user memory addresses may be used to map kernel memory. Detect these cases and fail bpf_probe_write_user() in such cases. Suggested-by:

Jann Horn <jannh@google.com> Reported-by:

Jann Horn <jannh@google.com> Signed-off-by:

Nadav Amit <namit@vmware.com> Signed-off-by:

Rick Edgecombe <rick.p.edgecombe@intel.com> Signed-off-by:

Peter Zijlstra (Intel) <peterz@infradead.org> Cc: <akpm@linux-foundation.org> Cc: <ard.biesheuvel@linaro.org> Cc: <deneen.t.dock@intel.com> Cc: <kernel-hardening@lists.openwall.com> Cc: <kristen@linux.intel.com> Cc: <linux_dti@icloud.com> Cc: <will.deacon@arm.com> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Andy Lutomirski <luto@kernel.org> Cc: Borislav Petkov <bp@alien8.de> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Rik van Riel <riel@surriel.com> Cc: Thomas Gleixner <tglx@linutronix.de> Link: https://lkml.kernel.org/r/20190426001143.4983-24-namit@vmware.com Signed-off-by:

Ingo Molnar <mingo@kernel.org>

kernel/trace/bpf_trace.c

+8 −0

Original line number	Original line	Diff line number	Diff line
	@@ -14,6 +14,8 @@
	#include <linux/syscalls.h>		#include <linux/syscalls.h>
	#include <linux/error-injection.h>		#include <linux/error-injection.h>

			#include <asm/tlb.h>

	#include "trace_probe.h"		#include "trace_probe.h"
	#include "trace.h"		#include "trace.h"

	@@ -163,6 +165,10 @@ BPF_CALL_3(bpf_probe_write_user, void , unsafe_ptr, const void , src,
	* access_ok() should prevent writing to non-user memory, but in		* access_ok() should prevent writing to non-user memory, but in
	* some situations (nommu, temporary switch, etc) access_ok() does		* some situations (nommu, temporary switch, etc) access_ok() does
	* not provide enough validation, hence the check on KERNEL_DS.		* not provide enough validation, hence the check on KERNEL_DS.
			*
			* nmi_uaccess_okay() ensures the probe is not run in an interim
			* state, when the task or mm are switched. This is specifically
			* required to prevent the use of temporary mm.
	*/		*/

	if (unlikely(in_interrupt() \|\|		if (unlikely(in_interrupt() \|\|
	@@ -170,6 +176,8 @@ BPF_CALL_3(bpf_probe_write_user, void , unsafe_ptr, const void , src,
	return -EPERM;		return -EPERM;
	if (unlikely(uaccess_kernel()))		if (unlikely(uaccess_kernel()))
	return -EPERM;		return -EPERM;
			if (unlikely(!nmi_uaccess_okay()))
			return -EPERM;
	if (!access_ok(unsafe_ptr, size))		if (!access_ok(unsafe_ptr, size))
	return -EPERM;		return -EPERM;

Admin message