Commit ce69fb3b authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'kallsyms_show_value-v5.8-rc5' of... 

Merge tag 'kallsyms_show_value-v5.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull kallsyms fix from Kees Cook:
 "Refactor kallsyms_show_value() users for correct cred.

  I'm not delighted by the timing of getting these changes to you, but
  it does fix a handful of kernel address exposures, and no one has
  screamed yet at the patches.

  Several users of kallsyms_show_value() were performing checks not
  during "open". Refactor everything needed to gain proper checks
  against file->f_cred for modules, kprobes, and bpf"

* tag 'kallsyms_show_value-v5.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  selftests: kmod: Add module address visibility test
  bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok()
  kprobes: Do not expose probe addresses to non-CAP_SYSLOG
  module: Do not expose section addresses to non-CAP_SYSLOG
  module: Refactor section attr into bin attribute
  kallsyms: Refactor kallsyms_show_value() to take cred
parents 0bddd227 2c795839

include/linux/filter.h

+2 −2
Original line number Diff line number Diff line
@@ -884,12 +884,12 @@ void bpf_jit_compile(struct bpf_prog *prog); 
bool bpf_jit_needs_zext(void);

bool bpf_helper_changes_pkt_data(void *func);



static inline bool bpf_dump_raw_ok(void)

static inline bool bpf_dump_raw_ok(const struct cred *cred)

{

	/* Reconstruction of call-sites is dependent on kallsyms,

	 * thus make dump the same restriction.

	 */

	return kallsyms_show_value() == 1;

	return kallsyms_show_value(cred);

}



struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,

include/linux/kallsyms.h

+3 −2
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ 
#define KSYM_SYMBOL_LEN (sizeof("%s+%#lx/%#lx [%s]") + (KSYM_NAME_LEN - 1) + \

			 2*(BITS_PER_LONG*3/10) + (MODULE_NAME_LEN - 1) + 1)



struct cred;

struct module;



static inline int is_kernel_inittext(unsigned long addr)
@@ -98,7 +99,7 @@ int lookup_symbol_name(unsigned long addr, char *symname); 
int lookup_symbol_attrs(unsigned long addr, unsigned long *size, unsigned long *offset, char *modname, char *name);



/* How and when do we show kallsyms values? */

extern int kallsyms_show_value(void);

extern bool kallsyms_show_value(const struct cred *cred);



#else /* !CONFIG_KALLSYMS */
@@ -158,7 +159,7 @@ static inline int lookup_symbol_attrs(unsigned long addr, unsigned long *size, u 
	return -ERANGE;

}



static inline int kallsyms_show_value(void)

static inline bool kallsyms_show_value(const struct cred *cred)

{

	return false;

}

kernel/bpf/syscall.c

+21 −16
Original line number Diff line number Diff line
@@ -3139,7 +3139,8 @@ static const struct bpf_map *bpf_map_from_imm(const struct bpf_prog *prog, 
	return NULL;

}



static struct bpf_insn *bpf_insn_prepare_dump(const struct bpf_prog *prog)

static struct bpf_insn *bpf_insn_prepare_dump(const struct bpf_prog *prog,

					      const struct cred *f_cred)

{

	const struct bpf_map *map;

	struct bpf_insn *insns;
@@ -3165,7 +3166,7 @@ static struct bpf_insn *bpf_insn_prepare_dump(const struct bpf_prog *prog) 
		    code == (BPF_JMP | BPF_CALL_ARGS)) {

			if (code == (BPF_JMP | BPF_CALL_ARGS))

				insns[i].code = BPF_JMP | BPF_CALL;

			if (!bpf_dump_raw_ok())

			if (!bpf_dump_raw_ok(f_cred))

				insns[i].imm = 0;

			continue;

		}
@@ -3221,7 +3222,8 @@ static int set_info_rec_size(struct bpf_prog_info *info) 
	return 0;

}



static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,

static int bpf_prog_get_info_by_fd(struct file *file,

				   struct bpf_prog *prog,

				   const union bpf_attr *attr,

				   union bpf_attr __user *uattr)

{
@@ -3290,11 +3292,11 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog, 
		struct bpf_insn *insns_sanitized;

		bool fault;



		if (prog->blinded && !bpf_dump_raw_ok()) {

		if (prog->blinded && !bpf_dump_raw_ok(file->f_cred)) {

			info.xlated_prog_insns = 0;

			goto done;

		}

		insns_sanitized = bpf_insn_prepare_dump(prog);

		insns_sanitized = bpf_insn_prepare_dump(prog, file->f_cred);

		if (!insns_sanitized)

			return -ENOMEM;

		uinsns = u64_to_user_ptr(info.xlated_prog_insns);
@@ -3328,7 +3330,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog, 
	}



	if (info.jited_prog_len && ulen) {

		if (bpf_dump_raw_ok()) {

		if (bpf_dump_raw_ok(file->f_cred)) {

			uinsns = u64_to_user_ptr(info.jited_prog_insns);

			ulen = min_t(u32, info.jited_prog_len, ulen);
@@ -3363,7 +3365,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog, 
	ulen = info.nr_jited_ksyms;

	info.nr_jited_ksyms = prog->aux->func_cnt ? : 1;

	if (ulen) {

		if (bpf_dump_raw_ok()) {

		if (bpf_dump_raw_ok(file->f_cred)) {

			unsigned long ksym_addr;

			u64 __user *user_ksyms;

			u32 i;
@@ -3394,7 +3396,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog, 
	ulen = info.nr_jited_func_lens;

	info.nr_jited_func_lens = prog->aux->func_cnt ? : 1;

	if (ulen) {

		if (bpf_dump_raw_ok()) {

		if (bpf_dump_raw_ok(file->f_cred)) {

			u32 __user *user_lens;

			u32 func_len, i;
@@ -3451,7 +3453,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog, 
	else

		info.nr_jited_line_info = 0;

	if (info.nr_jited_line_info && ulen) {

		if (bpf_dump_raw_ok()) {

		if (bpf_dump_raw_ok(file->f_cred)) {

			__u64 __user *user_linfo;

			u32 i;
@@ -3497,7 +3499,8 @@ done: 
	return 0;

}



static int bpf_map_get_info_by_fd(struct bpf_map *map,

static int bpf_map_get_info_by_fd(struct file *file,

				  struct bpf_map *map,

				  const union bpf_attr *attr,

				  union bpf_attr __user *uattr)

{
@@ -3540,7 +3543,8 @@ static int bpf_map_get_info_by_fd(struct bpf_map *map, 
	return 0;

}



static int bpf_btf_get_info_by_fd(struct btf *btf,

static int bpf_btf_get_info_by_fd(struct file *file,

				  struct btf *btf,

				  const union bpf_attr *attr,

				  union bpf_attr __user *uattr)

{
@@ -3555,7 +3559,8 @@ static int bpf_btf_get_info_by_fd(struct btf *btf, 
	return btf_get_info_by_fd(btf, attr, uattr);

}



static int bpf_link_get_info_by_fd(struct bpf_link *link,

static int bpf_link_get_info_by_fd(struct file *file,

				  struct bpf_link *link,

				  const union bpf_attr *attr,

				  union bpf_attr __user *uattr)

{
@@ -3608,15 +3613,15 @@ static int bpf_obj_get_info_by_fd(const union bpf_attr *attr, 
		return -EBADFD;



	if (f.file->f_op == &bpf_prog_fops)

		err = bpf_prog_get_info_by_fd(f.file->private_data, attr,

		err = bpf_prog_get_info_by_fd(f.file, f.file->private_data, attr,

					      uattr);

	else if (f.file->f_op == &bpf_map_fops)

		err = bpf_map_get_info_by_fd(f.file->private_data, attr,

		err = bpf_map_get_info_by_fd(f.file, f.file->private_data, attr,

					     uattr);

	else if (f.file->f_op == &btf_fops)

		err = bpf_btf_get_info_by_fd(f.file->private_data, attr, uattr);

		err = bpf_btf_get_info_by_fd(f.file, f.file->private_data, attr, uattr);

	else if (f.file->f_op == &bpf_link_fops)

		err = bpf_link_get_info_by_fd(f.file->private_data,

		err = bpf_link_get_info_by_fd(f.file, f.file->private_data,

					      attr, uattr);

	else

		err = -EINVAL;

kernel/kallsyms.c

+11 −6
Original line number Diff line number Diff line
@@ -644,19 +644,20 @@ static inline int kallsyms_for_perf(void) 
 * Otherwise, require CAP_SYSLOG (assuming kptr_restrict isn't set to

 * block even that).

 */

int kallsyms_show_value(void)

bool kallsyms_show_value(const struct cred *cred)

{

	switch (kptr_restrict) {

	case 0:

		if (kallsyms_for_perf())

			return 1;

			return true;

	/* fallthrough */

	case 1:

		if (has_capability_noaudit(current, CAP_SYSLOG))

			return 1;

		if (security_capable(cred, &init_user_ns, CAP_SYSLOG,

				     CAP_OPT_NOAUDIT) == 0)

			return true;

	/* fallthrough */

	default:

		return 0;

		return false;

	}

}
@@ -673,7 +674,11 @@ static int kallsyms_open(struct inode *inode, struct file *file) 
		return -ENOMEM;

	reset_iter(iter, 0);



	iter->show_value = kallsyms_show_value();

	/*

	 * Instead of checking this on every s_show() call, cache

	 * the result here at open time.

	 */

	iter->show_value = kallsyms_show_value(file->f_cred);

	return 0;

}

kernel/kprobes.c

+2 −2
Original line number Diff line number Diff line
@@ -2448,7 +2448,7 @@ static void report_probe(struct seq_file *pi, struct kprobe *p, 
	else

		kprobe_type = "k";



	if (!kallsyms_show_value())

	if (!kallsyms_show_value(pi->file->f_cred))

		addr = NULL;



	if (sym)
@@ -2540,7 +2540,7 @@ static int kprobe_blacklist_seq_show(struct seq_file *m, void *v) 
	 * If /proc/kallsyms is not showing kernel address, we won't

	 * show them here either.

	 */

	if (!kallsyms_show_value())

	if (!kallsyms_show_value(m->file->f_cred))

		seq_printf(m, "0x%px-0x%px\t%ps\n", NULL, NULL,

			   (void *)ent->start_addr);

	else

CRA Git | Maintained and supported by SUSTech CRA and CCSE