iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/kernel
History
Chuang Wang 9ed1d9aeef bpf: Fix panic due to wrong pageattr of im->image 
In the scenario where livepatch and kretfunc coexist, the pageattr of
im->image is rox after arch_prepare_bpf_trampoline in
bpf_trampoline_update, and then modify_fentry or register_fentry returns
-EAGAIN from bpf_tramp_ftrace_ops_func, the BPF_TRAMP_F_ORIG_STACK flag
will be configured, and arch_prepare_bpf_trampoline will be re-executed.

At this time, because the pageattr of im->image is rox,
arch_prepare_bpf_trampoline will read and write im->image, which causes
a fault. as follows:

  insmod livepatch-sample.ko    # samples/livepatch/livepatch-sample.c
  bpftrace -e 'kretfunc:cmdline_proc_show {}'

BUG: unable to handle page fault for address: ffffffffa0206000
PGD 322d067 P4D 322d067 PUD 322e063 PMD 1297e067 PTE d428061
Oops: 0003 [#1] PREEMPT SMP PTI
CPU: 2 PID: 270 Comm: bpftrace Tainted: G            E K    6.1.0 #5
RIP: 0010:arch_prepare_bpf_trampoline+0xed/0x8c0
RSP: 0018:ffffc90001083ad8 EFLAGS: 00010202
RAX: ffffffffa0206000 RBX: 0000000000000020 RCX: 0000000000000000
RDX: ffffffffa0206001 RSI: ffffffffa0206000 RDI: 0000000000000030
RBP: ffffc90001083b70 R08: 0000000000000066 R09: ffff88800f51b400
R10: 000000002e72c6e5 R11: 00000000d0a15080 R12: ffff8880110a68c8
R13: 0000000000000000 R14: ffff88800f51b400 R15: ffffffff814fec10
FS:  00007f87bc0dc780(0000) GS:ffff88803e600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa0206000 CR3: 0000000010b70000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
 bpf_trampoline_update+0x25a/0x6b0
 __bpf_trampoline_link_prog+0x101/0x240
 bpf_trampoline_link_prog+0x2d/0x50
 bpf_tracing_prog_attach+0x24c/0x530
 bpf_raw_tp_link_attach+0x73/0x1d0
 __sys_bpf+0x100e/0x2570
 __x64_sys_bpf+0x1c/0x30
 do_syscall_64+0x5b/0x80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

With this patch, when modify_fentry or register_fentry returns -EAGAIN
from bpf_tramp_ftrace_ops_func, the pageattr of im->image will be reset
to nx+rw.

Cc: stable@vger.kernel.org
Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)")
Signed-off-by: Chuang Wang <nashuiliang@gmail.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20221224133146.780578-1-nashuiliang@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2022-12-28 13:46:28 -08:00
..
bpf
bpf: Fix panic due to wrong pageattr of im->image
2022-12-28 13:46:28 -08:00
cgroup
MM patches for 6.2-rc1.
2022-12-13 19:29:45 -08:00
configs
mm, slob: rename CONFIG_SLOB to CONFIG_SLOB_DEPRECATED
2022-12-01 00:09:20 +01:00
debug
kdb: use srcu console list iterator
2022-12-02 11:25:00 +01:00
dma
dma-mapping: reject __GFP_COMP in dma_alloc_attrs
2022-11-21 09:37:20 +01:00
entry
entry: kmsan: introduce kmsan_unpoison_entry_regs()
2022-10-03 14:03:25 -07:00
events
New Feature:
2022-12-17 14:06:53 -06:00
futex
futex: Resend potentially swallowed owner death notification
2022-12-02 12:20:24 +01:00
gcov
gcov: clang: fix the buffer overflow issue
2022-11-22 18:50:41 -08:00
irq
genirq/msi: Return MSI_XA_DOMAIN_SIZE as the maximum MSI index when no domain is present
2022-12-16 14:04:04 +00:00
kcsan
hardening updates for v6.2-rc1
2022-12-14 12:20:00 -08:00
livepatch
modules changes for v6.2-rc1
2022-12-13 14:05:39 -08:00
locking
MM patches for 6.2-rc1.
2022-12-13 19:29:45 -08:00
module
powerpc updates for 6.2
2022-12-19 07:13:33 -06:00
power
PM: sleep: Refine error message in try_to_freeze_tasks()
2022-12-06 12:04:34 +01:00
printk
Merge branch 'rework/console-list-lock' into for-linus
2022-12-08 11:46:56 +01:00
rcu
Urgent RCU pull request for v6.2
2022-12-21 07:59:57 -08:00
sched
hardening updates for v6.2-rc1
2022-12-14 12:20:00 -08:00
time
Random number generator updates for Linux 6.2-rc1.
2022-12-12 16:22:22 -08:00
trace
powerpc updates for 6.2
2022-12-19 07:13:33 -06:00
.gitignore
…
acct.c
acct: fix potential integer overflow in encode_comp_t()
2022-11-30 16:13:18 -08:00
async.c
Revert "module, async: async_synchronize_full() on module init iff async is used"
2022-02-03 11:20:34 -08:00
audit_fsnotify.c
audit: fix potential double free on error path from fsnotify_add_inode_mark
2022-08-22 18:50:06 -04:00
audit_tree.c
audit: use fsnotify group lock helpers
2022-04-25 14:37:28 +02:00
audit_watch.c
audit_init_parent(): constify path
2022-09-01 17:39:30 -04:00
audit.c
audit: use time_after to compare time
2022-08-29 19:47:03 -04:00
audit.h
audit: remove selinux_audit_rule_update() declaration
2022-09-07 11:30:15 -04:00
auditfilter.c
audit/stable-5.17 PR 20220110
2022-01-11 13:08:21 -08:00
auditsc.c
audit: unify audit_filter_{uring(), inode_name(), syscall()}
2022-10-17 14:24:42 -04:00
backtracetest.c
…
bounds.c
mm: multi-gen LRU: minimal implementation
2022-09-26 19:46:09 -07:00
capability.c
caps: use type safe idmapping helpers
2022-10-26 10:02:39 +02:00
cfi.c
cfi: Switch to -fsanitize=kcfi
2022-09-26 10:13:13 -07:00
compat.c
…
configs.c
…
context_tracking.c
MAINTAINERS: Add Paul as context tracking maintainer
2022-07-05 13:33:00 -07:00
cpu_pm.c
context_tracking: Take IRQ eqs entrypoints over RCU
2022-07-05 13:32:59 -07:00
cpu.c
cpu/hotplug: Do not bail-out in DYING/STARTING sections
2022-12-02 12:43:02 +01:00
crash_core.c
vmcoreinfo: warn if we exceed vmcoreinfo data size
2022-11-30 16:13:17 -08:00
crash_dump.c
…
cred.c
cred: Do not default to init_cred in prepare_kernel_cred()
2022-11-01 10:04:52 -07:00
delayacct.c
delayacct: support re-entrance detection of thrashing accounting
2022-09-26 19:46:07 -07:00
dma.c
…
exec_domain.c
…
exit.c
exit: Allow oops_limit to be disabled
2022-12-02 13:04:39 -08:00
extable.c
context_tracking: Take NMI eqs entrypoints over RCU
2022-07-05 13:32:59 -07:00
fail_function.c
fail_function: fix wrong use of fei_attr_remove()
2022-09-11 21:55:11 -07:00
fork.c
New Feature:
2022-12-17 14:06:53 -06:00
freezer.c
freezer,sched: Rewrite core freezer logic
2022-09-07 21:53:50 +02:00
gen_kheaders.sh
kbuild: build init/built-in.a just once
2022-09-29 04:40:15 +09:00
groups.c
security: Add LSM hook to setgroups() syscall
2022-07-15 18:21:49 +00:00
hung_task.c
sched: Fix more TASK_state comparisons
2022-09-30 16:50:39 +02:00
iomem.c
…
irq_work.c
irq_work: use kasan_record_aux_stack_noalloc() record callstack
2022-04-15 14:49:55 -07:00
jump_label.c
jump_label: Prevent key->enabled int overflow
2022-12-01 15:53:05 -08:00
kallsyms_internal.h
kallsyms: Reduce the memory occupied by kallsyms_seqs_of_names[]
2022-11-12 18:47:36 -08:00
kallsyms_selftest.c
kallsyms: Remove unneeded semicolon
2022-11-18 12:56:40 -08:00
kallsyms_selftest.h
kallsyms: Add self-test facility
2022-11-15 00:42:02 -08:00
kallsyms.c
kallsyms: Add self-test facility
2022-11-15 00:42:02 -08:00
kcmp.c
…
Kconfig.freezer
…
Kconfig.hz
…
Kconfig.locks
…
Kconfig.preempt
Revert "signal, x86: Delay calling signals in atomic on RT enabled kernels"
2022-03-31 10:36:55 +02:00
kcov.c
kcov: kmsan: unpoison area->list in kcov_remote_area_put()
2022-10-03 14:03:23 -07:00
kexec_core.c
kexec: remove the unneeded result variable
2022-11-18 13:55:07 -08:00
kexec_elf.c
…
kexec_file.c
kexec: replace crash_mem_range with range
2022-11-18 13:55:07 -08:00
kexec_internal.h
panic, kexec: make __crash_kexec() NMI safe
2022-09-11 21:55:06 -07:00
kexec.c
panic, kexec: make __crash_kexec() NMI safe
2022-09-11 21:55:06 -07:00
kheaders.c
…
kmod.c
…
kprobes.c
kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case
2022-11-18 10:15:34 +09:00
ksysfs.c
kernel/ksysfs.c: export kernel cpu byteorder
2022-11-10 19:07:31 +01:00
kthread.c
signal: break out of wait loops on kthread_stop()
2022-10-09 16:01:59 -07:00
latencytop.c
latencytop: use the last element of latency_record of system
2022-09-11 21:55:12 -07:00
Makefile
kallsyms: Add self-test facility
2022-11-15 00:42:02 -08:00
module_signature.c
…
notifier.c
notifier: repair slips in kernel-doc comments
2022-11-30 19:32:30 +01:00
nsproxy.c
fs/exec: switch timens when a task gets a new mm
2022-10-25 15:15:52 -07:00
padata.c
Kbuild updates for v6.2
2022-12-19 12:33:32 -06:00
panic.c
hardening updates for v6.2-rc1
2022-12-14 12:20:00 -08:00
params.c
Driver Core changes for 6.2-rc1
2022-12-16 03:54:54 -08:00
pid_namespace.c
kernel: pid_namespace: use NULL instead of using plain integer as pointer
2022-04-29 14:38:00 -07:00
pid.c
gfs2: Add glockfd debugfs file
2022-06-29 13:07:16 +02:00
profile.c
kernel/profile.c: simplify duplicated code in profile_setup()
2022-09-11 21:55:12 -07:00
ptrace.c
freezer,sched: Rewrite core freezer logic
2022-09-07 21:53:50 +02:00
range.c
…
reboot.c
kernel/reboot: Add SYS_OFF_MODE_RESTART_PREPARE mode
2022-10-04 15:59:36 +02:00
regset.c
…
relay.c
relay: fix type mismatch when allocating memory in relay_create_buf()
2022-12-11 19:30:19 -08:00
resource_kunit.c
…
resource.c
Driver Core changes for 6.2-rc1
2022-12-16 03:54:54 -08:00
rseq.c
rseq: Use pr_warn_once() when deprecated/unknown ABI flags are encountered
2022-11-14 09:58:32 +01:00
scftorture.c
scftorture: Fix distribution of short handler delays
2022-04-11 17:07:29 -07:00
scs.c
scs: add support for dynamic shadow call stacks
2022-11-09 18:06:35 +00:00
seccomp.c
seccomp: Add wait_killable semantic to seccomp user notifier
2022-05-03 14:11:58 -07:00
signal.c
hardening updates for v6.2-rc1
2022-12-14 12:20:00 -08:00
smp.c
bitmap patches for v6.1-rc1
2022-10-10 12:49:34 -07:00
smpboot.c
smpboot: use atomic_try_cmpxchg in cpu_wait_death and cpu_report_death
2022-09-11 21:55:10 -07:00
smpboot.h
…
softirq.c
context_tracking: Take IRQ eqs entrypoints over RCU
2022-07-05 13:32:59 -07:00
stackleak.c
stackleak: add on/off stack variants
2022-05-08 01:33:09 -07:00
stacktrace.c
uaccess: remove CONFIG_SET_FS
2022-02-25 09:36:06 +01:00
static_call_inline.c
static_call: Add call depth tracking support
2022-10-17 16:41:16 +02:00
static_call.c
static_call: Don't make __static_call_return0 static
2022-04-05 09:59:38 +02:00
stop_machine.c
Scheduler changes in this cycle were:
2022-05-24 11:11:13 -07:00
sys_ni.c
kernel/sys_ni: add compat entry for fadvise64_64
2022-08-20 15:17:45 -07:00
sys.c
Random number generator updates for Linux 6.1-rc1.
2022-10-10 10:41:21 -07:00
sysctl-test.c
kernel/sysctl-test: use SYSCTL_{ZERO/ONE_HUNDRED} instead of i_{zero/one_hundred}
2022-09-08 16:56:45 -07:00
sysctl.c
MM patches for 6.2-rc1.
2022-12-13 19:29:45 -08:00
task_work.c
task_work: use try_cmpxchg in task_work_add, task_work_cancel_match and task_work_run
2022-09-11 21:55:10 -07:00
taskstats.c
genetlink: start to validate reserved header bytes
2022-08-29 12:47:15 +01:00
torture.c
torture: Wake up kthreads after storing task_struct pointer
2022-02-01 17:24:39 -08:00
tracepoint.c
tracepoint: Optimize the critical region of mutex_lock in tracepoint_module_coming()
2022-09-26 13:01:18 -04:00
tsacct.c
taskstats: version 12 with thread group and exe info
2022-04-29 14:38:03 -07:00
ucount.c
ucounts: Split rlimit and ucount values and max values
2022-05-18 18:24:57 -05:00
uid16.c
…
uid16.h
…
umh.c
freezer,sched: Rewrite core freezer logic
2022-09-07 21:53:50 +02:00
up.c
…
user_namespace.c
ucounts: Split rlimit and ucount values and max values
2022-10-09 16:24:05 -07:00
user-return-notifier.c
…
user.c
kernel/user: Allow user_struct::locked_vm to be usable for iommufd
2022-11-30 20:16:49 -04:00
usermode_driver.c
blob_to_mnt(): kern_unmount() is needed to undo kern_mount()
2022-05-19 23:25:47 -04:00
utsname_sysctl.c
kernel/utsname_sysctl.c: Fix hostname polling
2022-10-23 12:01:01 -07:00
utsname.c
…
watch_queue.c
This was a moderately busy cycle for documentation, but nothing all that
2022-08-02 19:24:24 -07:00
watchdog_hld.c
Revert "printk: add functions to prefer direct printing"
2022-06-23 18:41:40 +02:00
watchdog.c
powerpc updates for 6.0
2022-08-06 16:38:17 -07:00
workqueue_internal.h
…
workqueue.c
workqueue: Make queue_rcu_work() use call_rcu_hurry()
2022-11-30 13:17:05 -08:00