Commit-ID: c7b6f29b6257532792fc722b68fcc0e00b5a856c Gitweb: https://git.kernel.org/tip/c7b6f29b6257532792fc722b68fcc0e00b5a856c Author: Nadav Amit <na...@vmware.com> AuthorDate: Thu, 25 Apr 2019 17:11:43 -0700 Committer: Ingo Molnar <mi...@kernel.org> CommitDate: Tue, 30 Apr 2019 12:37:48 +0200
bpf: Fail bpf_probe_write_user() while mm is switched When using a temporary mm, bpf_probe_write_user() should not be able to write to user memory, since user memory addresses may be used to map kernel memory. Detect these cases and fail bpf_probe_write_user() in such cases. Suggested-by: Jann Horn <ja...@google.com> Reported-by: Jann Horn <ja...@google.com> Signed-off-by: Nadav Amit <na...@vmware.com> Signed-off-by: Rick Edgecombe <rick.p.edgeco...@intel.com> Signed-off-by: Peter Zijlstra (Intel) <pet...@infradead.org> Cc: <a...@linux-foundation.org> Cc: <ard.biesheu...@linaro.org> Cc: <deneen.t.d...@intel.com> Cc: <kernel-harden...@lists.openwall.com> Cc: <kris...@linux.intel.com> Cc: <linux_...@icloud.com> Cc: <will.dea...@arm.com> Cc: Alexei Starovoitov <a...@kernel.org> Cc: Andy Lutomirski <l...@kernel.org> Cc: Borislav Petkov <b...@alien8.de> Cc: Daniel Borkmann <dan...@iogearbox.net> Cc: Dave Hansen <dave.han...@linux.intel.com> Cc: H. Peter Anvin <h...@zytor.com> Cc: Linus Torvalds <torva...@linux-foundation.org> Cc: Rik van Riel <r...@surriel.com> Cc: Thomas Gleixner <t...@linutronix.de> Link: https://lkml.kernel.org/r/20190426001143.4983-24-na...@vmware.com Signed-off-by: Ingo Molnar <mi...@kernel.org> --- kernel/trace/bpf_trace.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index d64c00afceb5..94b0e37d90ef 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -14,6 +14,8 @@ #include <linux/syscalls.h> #include <linux/error-injection.h> +#include <asm/tlb.h> + #include "trace_probe.h" #include "trace.h" @@ -163,6 +165,10 @@ BPF_CALL_3(bpf_probe_write_user, void *, unsafe_ptr, const void *, src, * access_ok() should prevent writing to non-user memory, but in * some situations (nommu, temporary switch, etc) access_ok() does * not provide enough validation, hence the check on KERNEL_DS. + * + * nmi_uaccess_okay() ensures the probe is not run in an interim + * state, when the task or mm are switched. This is specifically + * required to prevent the use of temporary mm. */ if (unlikely(in_interrupt() || @@ -170,6 +176,8 @@ BPF_CALL_3(bpf_probe_write_user, void *, unsafe_ptr, const void *, src, return -EPERM; if (unlikely(uaccess_kernel())) return -EPERM; + if (unlikely(!nmi_uaccess_okay())) + return -EPERM; if (!access_ok(unsafe_ptr, size)) return -EPERM;
