From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Tue, 30 Apr 2019 04:15:13 -0700 Sender: tip tree robot From: tip-bot for Nadav Amit Message-ID: In-Reply-To: <20190426001143.4983-24-namit@vmware.com> References: <20190426001143.4983-24-namit@vmware.com> Subject: [tip:x86/mm] bpf: Fail bpf_probe_write_user() while mm is switched MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline To: linux-tip-commits@vger.kernel.org Cc: luto@kernel.org, namit@vmware.com, linux_dti@icloud.com, ard.biesheuvel@linaro.org, will.deacon@arm.com, jannh@google.com, riel@surriel.com, rick.p.edgecombe@intel.com, kernel-hardening@lists.openwall.com, torvalds@linux-foundation.org, linux-kernel@vger.kernel.org, daniel@iogearbox.net, deneen.t.dock@intel.com, tglx@linutronix.de, ast@kernel.org, akpm@linux-foundation.org, mingo@kernel.org, kristen@linux.intel.com, peterz@infradead.org, bp@alien8.de, hpa@zytor.com, dave.hansen@linux.intel.com List-ID: Commit-ID: c7b6f29b6257532792fc722b68fcc0e00b5a856c Gitweb: https://git.kernel.org/tip/c7b6f29b6257532792fc722b68fcc0e00b5a856c Author: Nadav Amit AuthorDate: Thu, 25 Apr 2019 17:11:43 -0700 Committer: Ingo Molnar CommitDate: Tue, 30 Apr 2019 12:37:48 +0200 bpf: Fail bpf_probe_write_user() while mm is switched When using a temporary mm, bpf_probe_write_user() should not be able to write to user memory, since user memory addresses may be used to map kernel memory. Detect these cases and fail bpf_probe_write_user() in such cases. Suggested-by: Jann Horn Reported-by: Jann Horn Signed-off-by: Nadav Amit Signed-off-by: Rick Edgecombe Signed-off-by: Peter Zijlstra (Intel) Cc: Cc: Cc: Cc: Cc: Cc: Cc: Cc: Alexei Starovoitov Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Daniel Borkmann Cc: Dave Hansen Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Rik van Riel Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20190426001143.4983-24-namit@vmware.com Signed-off-by: Ingo Molnar --- kernel/trace/bpf_trace.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index d64c00afceb5..94b0e37d90ef 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -14,6 +14,8 @@ #include #include +#include + #include "trace_probe.h" #include "trace.h" @@ -163,6 +165,10 @@ BPF_CALL_3(bpf_probe_write_user, void *, unsafe_ptr, const void *, src, * access_ok() should prevent writing to non-user memory, but in * some situations (nommu, temporary switch, etc) access_ok() does * not provide enough validation, hence the check on KERNEL_DS. + * + * nmi_uaccess_okay() ensures the probe is not run in an interim + * state, when the task or mm are switched. This is specifically + * required to prevent the use of temporary mm. */ if (unlikely(in_interrupt() || @@ -170,6 +176,8 @@ BPF_CALL_3(bpf_probe_write_user, void *, unsafe_ptr, const void *, src, return -EPERM; if (unlikely(uaccess_kernel())) return -EPERM; + if (unlikely(!nmi_uaccess_okay())) + return -EPERM; if (!access_ok(unsafe_ptr, size)) return -EPERM;