From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8FEBB2163BE for ; Wed, 26 Feb 2025 02:13:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536034; cv=none; b=i4sFL4e2xizfu4qx6z28p3dqKjmL7W7xw15ll2S2psNM9Zad/kH7N6HPSaALxS/kt6lw7yvq4BiDV50dbPosZbYMcy9DpnvlPpP0dVNea/xzbjAm/girgZT4DdqcodvolcvGloV14HN1MmieQE4KJtHvXNS+RvUFtLeSzjg20HA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536034; c=relaxed/simple; bh=c95gyS9X9BQaGK7u8IkvWauV7yNFK9YeeLi3+UfA6zw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=jykiwOs0GGMkFkbOqMYYFAsF4PhRdvmPAw3g+Tn8wZOJ5LtqbG3VH+FHtfXwlZoACD3AbjKlEbBBk85SPVWEXSc1mQ3A9jKJbMgTRdwnKbztmc7pLnpIde6E6XorzeBjCWpDr0kAaGCyvlE4uvxWgANm0Qz1n8b9W0BYXnjYqvY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=esR97Z4v; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="esR97Z4v" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 66D79C4CEDD; Wed, 26 Feb 2025 02:13:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536034; bh=c95gyS9X9BQaGK7u8IkvWauV7yNFK9YeeLi3+UfA6zw=; h=From:To:Cc:Subject:Date:Reply-to:From; b=esR97Z4vSDEz7SVbY6t1lCrQwVhwr2cmyfxwR8+8GkkD1M+YFa6jJ31M4pbKr/UZ1 zQKZHb38WBbAk0EyKQ/9yj7tvEH0oCIgz5cUKpu+KZZQouLwAn+ApKxM84XRMrsTPp VzUMYuwFr+8JuqBl9qMskjkszFR1I3TQlHbva6tw= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49402: ftrace: Clean up hash direct_functions on register failures Date: Wed, 26 Feb 2025 03:11:16 +0100 Message-ID: <2025022651-CVE-2022-49402-73ee@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=5118; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=c95gyS9X9BQaGK7u8IkvWauV7yNFK9YeeLi3+UfA6zw=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7yt/frv8bJaD250dixougqs978oMb2n5mVgTVRpv7t mhmCs3piGVhEGRikBVTZPmyjefo/opDil6Gtqdh5rAygQxh4OIUgIlkv2RYMFtqV/zdTF/u+6dO a34x9NEwmjI7gGEmY+76thl3LoX+aF9RcvvzxQtlIneeAgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: ftrace: Clean up hash direct_functions on register failures We see the following GPF when register_ftrace_direct fails: [ ] general protection fault, probably for non-canonical address \ 0x200000000000010: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [...] [ ] RIP: 0010:ftrace_find_rec_direct+0x53/0x70 [ ] Code: 48 c1 e0 03 48 03 42 08 48 8b 10 31 c0 48 85 d2 74 [...] [ ] RSP: 0018:ffffc9000138bc10 EFLAGS: 00010206 [ ] RAX: 0000000000000000 RBX: ffffffff813e0df0 RCX: 000000000000003b [ ] RDX: 0200000000000000 RSI: 000000000000000c RDI: ffffffff813e0df0 [ ] RBP: ffffffffa00a3000 R08: ffffffff81180ce0 R09: 0000000000000001 [ ] R10: ffffc9000138bc18 R11: 0000000000000001 R12: ffffffff813e0df0 [ ] R13: ffffffff813e0df0 R14: ffff888171b56400 R15: 0000000000000000 [ ] FS: 00007fa9420c7780(0000) GS:ffff888ff6a00000(0000) knlGS:000000000 [ ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ ] CR2: 000000000770d000 CR3: 0000000107d50003 CR4: 0000000000370ee0 [ ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ ] Call Trace: [ ] [ ] register_ftrace_direct+0x54/0x290 [ ] ? render_sigset_t+0xa0/0xa0 [ ] bpf_trampoline_update+0x3f5/0x4a0 [ ] ? 0xffffffffa00a3000 [ ] bpf_trampoline_link_prog+0xa9/0x140 [ ] bpf_tracing_prog_attach+0x1dc/0x450 [ ] bpf_raw_tracepoint_open+0x9a/0x1e0 [ ] ? find_held_lock+0x2d/0x90 [ ] ? lock_release+0x150/0x430 [ ] __sys_bpf+0xbd6/0x2700 [ ] ? lock_is_held_type+0xd8/0x130 [ ] __x64_sys_bpf+0x1c/0x20 [ ] do_syscall_64+0x3a/0x80 [ ] entry_SYSCALL_64_after_hwframe+0x44/0xae [ ] RIP: 0033:0x7fa9421defa9 [ ] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 9 f8 [...] [ ] RSP: 002b:00007ffed743bd78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ ] RAX: ffffffffffffffda RBX: 00000000069d2480 RCX: 00007fa9421defa9 [ ] RDX: 0000000000000078 RSI: 00007ffed743bd80 RDI: 0000000000000011 [ ] RBP: 00007ffed743be00 R08: 0000000000bb7270 R09: 0000000000000000 [ ] R10: 00000000069da210 R11: 0000000000000246 R12: 0000000000000001 [ ] R13: 00007ffed743c4b0 R14: 00000000069d2480 R15: 0000000000000001 [ ] [ ] Modules linked in: klp_vm(OK) [ ] ---[ end trace 0000000000000000 ]--- One way to trigger this is: 1. load a livepatch that patches kernel function xxx; 2. run bpftrace -e 'kfunc:xxx {}', this will fail (expected for now); 3. repeat #2 => gpf. This is because the entry is added to direct_functions, but not removed. Fix this by remove the entry from direct_functions when register_ftrace_direct fails. Also remove the last trailing space from ftrace.c, so we don't have to worry about it anymore. The Linux kernel CVE team has assigned CVE-2022-49402 to this issue. Affected and fixed versions =========================== Issue introduced in 5.5 with commit 763e34e74bb7d5c316015e2e39fcc8520bfd071c and fixed in 5.10.121 with commit 82c888e51c2176a06f8b4541cf748ee81aac6e7e Issue introduced in 5.5 with commit 763e34e74bb7d5c316015e2e39fcc8520bfd071c and fixed in 5.15.46 with commit cae2978d6907ef2c08b9b15f704e783f7c284713 Issue introduced in 5.5 with commit 763e34e74bb7d5c316015e2e39fcc8520bfd071c and fixed in 5.17.14 with commit 805e87af946d8d2954171361e64d143ff37a441b Issue introduced in 5.5 with commit 763e34e74bb7d5c316015e2e39fcc8520bfd071c and fixed in 5.18.3 with commit a0392833a178cf109a57c2a9d4d531bdfc6cd98f Issue introduced in 5.5 with commit 763e34e74bb7d5c316015e2e39fcc8520bfd071c and fixed in 5.19 with commit 7d54c15cb89a29a5f59e5ffc9ee62e6591769ef1 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49402 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: kernel/trace/ftrace.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/82c888e51c2176a06f8b4541cf748ee81aac6e7e https://git.kernel.org/stable/c/cae2978d6907ef2c08b9b15f704e783f7c284713 https://git.kernel.org/stable/c/805e87af946d8d2954171361e64d143ff37a441b https://git.kernel.org/stable/c/a0392833a178cf109a57c2a9d4d531bdfc6cd98f https://git.kernel.org/stable/c/7d54c15cb89a29a5f59e5ffc9ee62e6591769ef1