Alexei Starovoitov 18644cec71 bpf: Fix use-after-free in fmod_ret check ... Fix the following issue: [ 436.749342] BUG: KASAN: use-after-free in bpf_trampoline_put+0x39/0x2a0 [ 436.749995] Write of size 4 at addr ffff8881ef38b8a0 by task kworker/3:5/2243 [ 436.750712] [ 436.752677] Workqueue: events bpf_prog_free_deferred [ 436.753183] Call Trace: [ 436.756483] bpf_trampoline_put+0x39/0x2a0 [ 436.756904] bpf_prog_free_deferred+0x16d/0x3d0 [ 436.757377] process_one_work+0x94a/0x15b0 [ 436.761969] [ 436.762130] Allocated by task 2529: [ 436.763323] bpf_trampoline_lookup+0x136/0x540 [ 436.763776] bpf_check+0x2872/0xa0a8 [ 436.764144] bpf_prog_load+0xb6f/0x1350 [ 436.764539] __do_sys_bpf+0x16d7/0x3720 [ 436.765825] [ 436.765988] Freed by task 2529: [ 436.767084] kfree+0xc6/0x280 [ 436.767397] bpf_trampoline_put+0x1fd/0x2a0 [ 436.767826] bpf_check+0x6832/0xa0a8 [ 436.768197] bpf_prog_load+0xb6f/0x1350 [ 436.768594] __do_sys_bpf+0x16d7/0x3720 prog->aux->trampoline = tr should be set only when prog is valid. Otherwise prog freeing will try to put trampoline via prog->aux->trampoline, but it may not point to a valid trampoline. Fixes: 6ba43b761c ("bpf: Attachment verification for BPF_MODIFY_RETURN") Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: KP Singh <kpsingh@google.com> Link: https://lore.kernel.org/bpf/20200529043839.15824-2-alexei.starovoitov@gmail.com		2020-05-29 22:25:58 +02:00
..
arraymap.c	bpf: Fix bug in mmap() implementation for BPF array map	2020-05-14 12:40:04 -07:00
bpf_lru_list.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 206	2019-05-30 11:29:53 -07:00
bpf_lru_list.h	bpf: Fix a typo "inacitve" -> "inactive"	2020-04-06 21:54:10 +02:00
bpf_lsm.c	bpf: lsm: Implement attach, detach and execution	2020-03-30 01:34:00 +02:00
bpf_struct_ops_types.h	bpf: tcp: Support tcp_congestion_ops in bpf	2020-01-09 08:46:18 -08:00
bpf_struct_ops.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-03-25 18:58:11 -07:00
btf.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2020-03-30 19:52:37 -07:00
cgroup.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2020-03-30 19:52:37 -07:00
core.c	bpf: Enable bpf cgroup hooks to retrieve cgroup v2 and ancestor id	2020-03-27 19:40:39 -07:00
cpumap.c	cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled	2020-04-20 18:38:04 -07:00
devmap.c	bpf, xdp: Remove no longer required rcu_read_{un}lock()	2020-01-27 11:16:25 +01:00
disasm.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295	2019-06-05 17:36:38 +02:00
disasm.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295	2019-06-05 17:36:38 +02:00
dispatcher.c	bpf: Remove bpf_image tree	2020-03-13 12:49:52 -07:00
hashtab.c	bpf: Replace zero-length array with flexible-array member	2020-02-28 01:21:02 +01:00
helpers.c	bpf: Enable bpf cgroup hooks to retrieve cgroup v2 and ancestor id	2020-03-27 19:40:39 -07:00
inode.c	bpf: Introduce pinnable bpf_link abstraction	2020-03-02 22:06:27 -08:00
local_storage.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-12-22 09:54:33 -08:00
lpm_trie.c	bpf: Replace zero-length array with flexible-array member	2020-02-28 01:21:02 +01:00
Makefile	bpf: Introduce BPF_PROG_TYPE_LSM	2020-03-30 01:34:00 +02:00
map_in_map.c	bpf: Introduce BPF_MAP_TYPE_STRUCT_OPS	2020-01-09 08:46:18 -08:00
map_in_map.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 206	2019-05-30 11:29:53 -07:00
offload.c	bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill	2020-02-17 16:53:49 +01:00
percpu_freelist.c	bpf: Dont iterate over possible CPUs with interrupts disabled	2020-02-24 16:18:20 -08:00
percpu_freelist.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 206	2019-05-30 11:29:53 -07:00
queue_stack_maps.c	bpf: move memory size checks to bpf_map_charge_init()	2019-05-31 16:52:56 -07:00
reuseport_array.c	net: Generate reuseport group ID on group creation	2020-02-21 22:29:45 +01:00
stackmap.c	bpf/stackmap: Dont trylock mmap_sem with PREEMPT_RT and interrupts disabled	2020-02-24 16:20:10 -08:00
syscall.c	bpf: Prevent mmap()'ing read-only maps as writable	2020-05-20 20:21:53 -07:00
sysfs_btf.c	bpf: Support llvm-objcopy for vmlinux BTF	2020-03-19 12:32:38 +01:00
tnum.c	bpf: Verifier, do explicit ALU32 bounds tracking	2020-03-30 14:59:53 -07:00
trampoline.c	bpf: lsm: Implement attach, detach and execution	2020-03-30 01:34:00 +02:00
verifier.c	bpf: Fix use-after-free in fmod_ret check	2020-05-29 22:25:58 +02:00
xskmap.c	xsk: Make xskmap flush_list common for all map instances	2019-12-19 21:09:43 -08:00