sieni
/
linux
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
linux/tools
History
Kumar Kartikeya Dwivedi 4656569643 selftests/bpf: Add test for race in btf_try_get_module 
This adds a complete test case to ensure we never take references to
modules not in MODULE_STATE_LIVE, which can lead to UAF, and it also
ensures we never access btf->kfunc_set_tab in an inconsistent state.

The test uses userfaultfd to artificially widen the race.

When run on an unpatched kernel, it leads to the following splat:

[root@(none) bpf]# ./test_progs -t bpf_mod_race/ksym
[   55.498171] BUG: unable to handle page fault for address: fffffbfff802548b
[   55.499206] #PF: supervisor read access in kernel mode
[   55.499855] #PF: error_code(0x0000) - not-present page
[   55.500555] PGD a4fa9067 P4D a4fa9067 PUD a4fa5067 PMD 1b44067 PTE 0
[   55.501499] Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
[   55.502195] CPU: 0 PID: 83 Comm: kworker/0:2 Tainted: G           OE     5.16.0-rc4+ #151
[   55.503388] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.15.0-1 04/01/2014
[   55.504777] Workqueue: events bpf_prog_free_deferred
[   55.505563] RIP: 0010:kasan_check_range+0x184/0x1d0
[   55.509140] RSP: 0018:ffff88800560fcf0 EFLAGS: 00010282
[   55.509977] RAX: fffffbfff802548b RBX: fffffbfff802548c RCX: ffffffff9337b6ba
[   55.511096] RDX: fffffbfff802548c RSI: 0000000000000004 RDI: ffffffffc012a458
[   55.512143] RBP: fffffbfff802548b R08: 0000000000000001 R09: ffffffffc012a45b
[   55.513228] R10: fffffbfff802548b R11: 0000000000000001 R12: ffff888001b5f598
[   55.514332] R13: ffff888004f49ac8 R14: 0000000000000000 R15: ffff888092449400
[   55.515418] FS:  0000000000000000(0000) GS:ffff888092400000(0000) knlGS:0000000000000000
[   55.516705] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   55.517560] CR2: fffffbfff802548b CR3: 0000000007c10006 CR4: 0000000000770ef0
[   55.518672] PKRU: 55555554
[   55.519022] Call Trace:
[   55.519483]  <TASK>
[   55.519884]  module_put.part.0+0x2a/0x180
[   55.520642]  bpf_prog_free_deferred+0x129/0x2e0
[   55.521478]  process_one_work+0x4fa/0x9e0
[   55.522122]  ? pwq_dec_nr_in_flight+0x100/0x100
[   55.522878]  ? rwlock_bug.part.0+0x60/0x60
[   55.523551]  worker_thread+0x2eb/0x700
[   55.524176]  ? __kthread_parkme+0xd8/0xf0
[   55.524853]  ? process_one_work+0x9e0/0x9e0
[   55.525544]  kthread+0x23a/0x270
[   55.526088]  ? set_kthread_struct+0x80/0x80
[   55.526798]  ret_from_fork+0x1f/0x30
[   55.527413]  </TASK>
[   55.527813] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod]
[   55.530846] CR2: fffffbfff802548b
[   55.531341] ---[ end trace 1af41803c054ad6d ]---
[   55.532136] RIP: 0010:kasan_check_range+0x184/0x1d0
[   55.535887] RSP: 0018:ffff88800560fcf0 EFLAGS: 00010282
[   55.536711] RAX: fffffbfff802548b RBX: fffffbfff802548c RCX: ffffffff9337b6ba
[   55.537821] RDX: fffffbfff802548c RSI: 0000000000000004 RDI: ffffffffc012a458
[   55.538899] RBP: fffffbfff802548b R08: 0000000000000001 R09: ffffffffc012a45b
[   55.539928] R10: fffffbfff802548b R11: 0000000000000001 R12: ffff888001b5f598
[   55.541021] R13: ffff888004f49ac8 R14: 0000000000000000 R15: ffff888092449400
[   55.542108] FS:  0000000000000000(0000) GS:ffff888092400000(0000) knlGS:0000000000000000
[   55.543260]CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   55.544136] CR2: fffffbfff802548b CR3: 0000000007c10006 CR4: 0000000000770ef0
[   55.545317] PKRU: 55555554
[   55.545671] note: kworker/0:2[83] exited with preempt_count 1

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20220114163953.1455836-11-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 		2022-01-18 14:27:39 -08:00
..
accounting
…
arch tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources 2021-11-18 10:08:07 -03:00
bootconfig bootconfig: Cleanup dummy headers in tools/bootconfig 2021-10-10 22:16:02 -04:00
bpf tools/resolve_btfids: Build with host flags 2022-01-14 16:53:23 -08:00
build Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2021-12-10 15:56:13 -08:00
cgroup
…
counter tools/counter: Create Counter tools 2021-10-17 10:54:16 +01:00
debugging tools: Fix "the the" in a message in kernel-chktaint 2021-06-13 17:01:17 -06:00
edid
…
firewire
…
firmware
…
gpio
…
hv
…
iio
…
include Networking changes for 5.17. 2022-01-10 19:06:09 -08:00
io_uring tools/io_uring/io_uring-cp: sync with liburing example 2021-08-13 08:58:11 -06:00
kvm/kvm_stat KVM: kvm_stat: do not show halt_wait_ns 2021-10-18 14:07:18 -04:00
laptop
…
leds
…
lib libbpf: Deprecate bpf_map__def() API 2022-01-12 17:01:39 -08:00
memory-model tools/memory-model: Document data_race(READ_ONCE()) 2021-07-27 11:48:55 -07:00
objtool objtool: Fix pv_ops noinstr validation 2021-12-03 09:11:42 +01:00
pci tools: PCI: Zero-initialize param 2021-08-05 11:01:30 +01:00
pcmcia
…
perf perf: Stop using bpf_map__def() API 2022-01-12 17:01:38 -08:00
power ACPI: tools: Fix compilation when output directory is not present 2021-12-08 15:10:27 +01:00
rcu tools/rcu: Add an extract-stall script 2021-09-16 10:31:26 -07:00
scripts tools: Help cross-building with clang 2021-12-16 12:15:04 -08:00
spi
…
testing selftests/bpf: Add test for race in btf_try_get_module 2022-01-18 14:27:39 -08:00
thermal/tmon thermal: tools: tmon: remove unneeded local variable 2021-11-24 17:26:13 +01:00
time
…
tracing tools/latency-collector: Use correct size when writing queue_full_warning 2021-10-25 22:27:19 -04:00
usb usb: testusb: Fix for showing the connection speed 2021-09-14 10:31:41 +02:00
virtio tools/virtio: fix build 2021-08-11 06:44:24 -04:00
vm tools/vm/page-types.c: print file offset in hexadecimal 2021-11-06 13:30:40 -07:00
wmi
…
Makefile tools/lib/lockdep: drop liblockdep 2021-11-12 11:07:17 -08:00