Alexei Starovoitov 18644cec71 bpf: Fix use-after-free in fmod_ret check ... Fix the following issue: [ 436.749342] BUG: KASAN: use-after-free in bpf_trampoline_put+0x39/0x2a0 [ 436.749995] Write of size 4 at addr ffff8881ef38b8a0 by task kworker/3:5/2243 [ 436.750712] [ 436.752677] Workqueue: events bpf_prog_free_deferred [ 436.753183] Call Trace: [ 436.756483] bpf_trampoline_put+0x39/0x2a0 [ 436.756904] bpf_prog_free_deferred+0x16d/0x3d0 [ 436.757377] process_one_work+0x94a/0x15b0 [ 436.761969] [ 436.762130] Allocated by task 2529: [ 436.763323] bpf_trampoline_lookup+0x136/0x540 [ 436.763776] bpf_check+0x2872/0xa0a8 [ 436.764144] bpf_prog_load+0xb6f/0x1350 [ 436.764539] __do_sys_bpf+0x16d7/0x3720 [ 436.765825] [ 436.765988] Freed by task 2529: [ 436.767084] kfree+0xc6/0x280 [ 436.767397] bpf_trampoline_put+0x1fd/0x2a0 [ 436.767826] bpf_check+0x6832/0xa0a8 [ 436.768197] bpf_prog_load+0xb6f/0x1350 [ 436.768594] __do_sys_bpf+0x16d7/0x3720 prog->aux->trampoline = tr should be set only when prog is valid. Otherwise prog freeing will try to put trampoline via prog->aux->trampoline, but it may not point to a valid trampoline. Fixes: 6ba43b761c ("bpf: Attachment verification for BPF_MODIFY_RETURN") Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: KP Singh <kpsingh@google.com> Link: https://lore.kernel.org/bpf/20200529043839.15824-2-alexei.starovoitov@gmail.com		2020-05-29 22:25:58 +02:00
..
arraymap.c	bpf: Fix bug in mmap() implementation for BPF array map	2020-05-14 12:40:04 -07:00
bpf_lru_list.c
bpf_lru_list.h	bpf: Fix a typo "inacitve" -> "inactive"	2020-04-06 21:54:10 +02:00
bpf_lsm.c	bpf: lsm: Implement attach, detach and execution	2020-03-30 01:34:00 +02:00
bpf_struct_ops.c
bpf_struct_ops_types.h
btf.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2020-03-30 19:52:37 -07:00
cgroup.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2020-03-30 19:52:37 -07:00
core.c
cpumap.c	cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled	2020-04-20 18:38:04 -07:00
devmap.c
disasm.c
disasm.h
dispatcher.c
hashtab.c
helpers.c
inode.c
local_storage.c
lpm_trie.c
Makefile	bpf: Introduce BPF_PROG_TYPE_LSM	2020-03-30 01:34:00 +02:00
map_in_map.c
map_in_map.h
offload.c
percpu_freelist.c
percpu_freelist.h
queue_stack_maps.c
reuseport_array.c
stackmap.c
syscall.c	bpf: Prevent mmap()'ing read-only maps as writable	2020-05-20 20:21:53 -07:00
sysfs_btf.c
tnum.c	bpf: Verifier, do explicit ALU32 bounds tracking	2020-03-30 14:59:53 -07:00
trampoline.c	bpf: lsm: Implement attach, detach and execution	2020-03-30 01:34:00 +02:00
verifier.c	bpf: Fix use-after-free in fmod_ret check	2020-05-29 22:25:58 +02:00
xskmap.c