From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0331D208B8 for ; Thu, 22 Aug 2024 03:34:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724297657; cv=none; b=QNKZS77IxEQwwSx6h3q0+AogSAKbhMSgZCHXUuhgKiTkFJznYFlDqLesafhdeW8q/gulzfgfnUI+hW8l8FPtdsEnSawoSdFNsWl9yj2RBmSh4pB582VYXkinuyZbL1/Q+V/6rw2loLz1Tjx5KA6v/yCXMZdyKK79QeBkNNHWGts= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724297657; c=relaxed/simple; bh=150scbMjZ1L4/J6lcJiWma5i0lDmil5uUPFcKPc4BdI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=NAOmf046n+FLZTK1cSAhhUxu3gfpD5FReKmfrK+AGErLC/X3Jxr9M0MAdCZGulmn12WIASice1v/ClVlVM/UT9i9SS2CFvPUkec35M6R9OoWeo6iZZv2fV11eugh03lAfrJWyYq4WL3/9VQhdrdORmi7Re3uwnN4bPo+YPKDtWE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bscZJLsd; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="bscZJLsd" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8C6EFC4AF0B; Thu, 22 Aug 2024 03:34:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1724297656; bh=150scbMjZ1L4/J6lcJiWma5i0lDmil5uUPFcKPc4BdI=; h=From:To:Cc:Subject:Date:Reply-to:From; b=bscZJLsdlPw5rkxuTUT0LGCtzlZk+P4uOVWawF2UmMUis4eG84ir/mUHq4puhwma/ CnA/uFoaqfUrySjCxvGYlHrdAYRln+8W1Y4tQ2m/LjWgTxuUJmnXcBmcDzPYe0v5l1 5DjsAJPEK0C4AR/YKcpVvkcAu//fUPZOP2sc0hxo= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-48940: bpf: Fix crash due to incorrect copy_map_value Date: Thu, 22 Aug 2024 11:31:41 +0800 Message-ID: <2024082226-CVE-2022-48940-da55@gregkh> X-Mailer: git-send-email 2.46.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4938; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=150scbMjZ1L4/J6lcJiWma5i0lDmil5uUPFcKPc4BdI=; b=owGbwMvMwCRo6H6F97bub03G02pJDGnHNvKVJrfmv3v8eN6jrLmLfV4cObLzhfEyhfrf/QKat 4K3ydVndMSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEJixiWHBYqMtbKWTRjw3v HNKre+faOUU/O8SwoNl7qdZ8xg8FpxrbtZacqrN8tzJiMwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: bpf: Fix crash due to incorrect copy_map_value When both bpf_spin_lock and bpf_timer are present in a BPF map value, copy_map_value needs to skirt both objects when copying a value into and out of the map. However, the current code does not set both s_off and t_off in copy_map_value, which leads to a crash when e.g. bpf_spin_lock is placed in map value with bpf_timer, as bpf_map_update_elem call will be able to overwrite the other timer object. When the issue is not fixed, an overwriting can produce the following splat: [root@(none) bpf]# ./test_progs -t timer_crash [ 15.930339] bpf_testmod: loading out-of-tree module taints kernel. [ 16.037849] ================================================================== [ 16.038458] BUG: KASAN: user-memory-access in __pv_queued_spin_lock_slowpath+0x32b/0x520 [ 16.038944] Write of size 8 at addr 0000000000043ec0 by task test_progs/325 [ 16.039399] [ 16.039514] CPU: 0 PID: 325 Comm: test_progs Tainted: G OE 5.16.0+ #278 [ 16.039983] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.15.0-1 04/01/2014 [ 16.040485] Call Trace: [ 16.040645] [ 16.040805] dump_stack_lvl+0x59/0x73 [ 16.041069] ? __pv_queued_spin_lock_slowpath+0x32b/0x520 [ 16.041427] kasan_report.cold+0x116/0x11b [ 16.041673] ? __pv_queued_spin_lock_slowpath+0x32b/0x520 [ 16.042040] __pv_queued_spin_lock_slowpath+0x32b/0x520 [ 16.042328] ? memcpy+0x39/0x60 [ 16.042552] ? pv_hash+0xd0/0xd0 [ 16.042785] ? lockdep_hardirqs_off+0x95/0xd0 [ 16.043079] __bpf_spin_lock_irqsave+0xdf/0xf0 [ 16.043366] ? bpf_get_current_comm+0x50/0x50 [ 16.043608] ? jhash+0x11a/0x270 [ 16.043848] bpf_timer_cancel+0x34/0xe0 [ 16.044119] bpf_prog_c4ea1c0f7449940d_sys_enter+0x7c/0x81 [ 16.044500] bpf_trampoline_6442477838_0+0x36/0x1000 [ 16.044836] __x64_sys_nanosleep+0x5/0x140 [ 16.045119] do_syscall_64+0x59/0x80 [ 16.045377] ? lock_is_held_type+0xe4/0x140 [ 16.045670] ? irqentry_exit_to_user_mode+0xa/0x40 [ 16.046001] ? mark_held_locks+0x24/0x90 [ 16.046287] ? asm_exc_page_fault+0x1e/0x30 [ 16.046569] ? asm_exc_page_fault+0x8/0x30 [ 16.046851] ? lockdep_hardirqs_on+0x7e/0x100 [ 16.047137] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 16.047405] RIP: 0033:0x7f9e4831718d [ 16.047602] Code: b4 0c 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b3 6c 0c 00 f7 d8 64 89 01 48 [ 16.048764] RSP: 002b:00007fff488086b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000023 [ 16.049275] RAX: ffffffffffffffda RBX: 00007f9e48683740 RCX: 00007f9e4831718d [ 16.049747] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff488086d0 [ 16.050225] RBP: 00007fff488086f0 R08: 00007fff488085d7 R09: 00007f9e4cb594a0 [ 16.050648] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f9e484cde30 [ 16.051124] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 16.051608] [ 16.051762] ================================================================== The Linux kernel CVE team has assigned CVE-2022-48940 to this issue. Affected and fixed versions =========================== Issue introduced in 5.15 with commit 68134668c17f and fixed in 5.15.26 with commit 719d1c2524c8 Issue introduced in 5.15 with commit 68134668c17f and fixed in 5.16.12 with commit eca9bd215d22 Issue introduced in 5.15 with commit 68134668c17f and fixed in 5.17 with commit a8abb0c3dc1e Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-48940 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/linux/bpf.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/719d1c2524c89ada78c4c9202641c1d9e942a322 https://git.kernel.org/stable/c/eca9bd215d2233de79d930fa97aefbce03247a98 https://git.kernel.org/stable/c/a8abb0c3dc1e28454851a00f8b7333d9695d566c