mirror of
https://gitee.com/bianbu-linux/linux-6.6
synced 2025-04-24 14:07:52 -04:00
This adds a complete test case to ensure we never take references to modules not in MODULE_STATE_LIVE, which can lead to UAF, and it also ensures we never access btf->kfunc_set_tab in an inconsistent state. The test uses userfaultfd to artificially widen the race. When run on an unpatched kernel, it leads to the following splat: [root@(none) bpf]# ./test_progs -t bpf_mod_race/ksym [ 55.498171] BUG: unable to handle page fault for address: fffffbfff802548b [ 55.499206] #PF: supervisor read access in kernel mode [ 55.499855] #PF: error_code(0x0000) - not-present page [ 55.500555] PGD a4fa9067 P4D a4fa9067 PUD a4fa5067 PMD 1b44067 PTE 0 [ 55.501499] Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 55.502195] CPU: 0 PID: 83 Comm: kworker/0:2 Tainted: G OE 5.16.0-rc4+ #151 [ 55.503388] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.15.0-1 04/01/2014 [ 55.504777] Workqueue: events bpf_prog_free_deferred [ 55.505563] RIP: 0010:kasan_check_range+0x184/0x1d0 [ 55.509140] RSP: 0018:ffff88800560fcf0 EFLAGS: 00010282 [ 55.509977] RAX: fffffbfff802548b RBX: fffffbfff802548c RCX: ffffffff9337b6ba [ 55.511096] RDX: fffffbfff802548c RSI: 0000000000000004 RDI: ffffffffc012a458 [ 55.512143] RBP: fffffbfff802548b R08: 0000000000000001 R09: ffffffffc012a45b [ 55.513228] R10: fffffbfff802548b R11: 0000000000000001 R12: ffff888001b5f598 [ 55.514332] R13: ffff888004f49ac8 R14: 0000000000000000 R15: ffff888092449400 [ 55.515418] FS: 0000000000000000(0000) GS:ffff888092400000(0000) knlGS:0000000000000000 [ 55.516705] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 55.517560] CR2: fffffbfff802548b CR3: 0000000007c10006 CR4: 0000000000770ef0 [ 55.518672] PKRU: 55555554 [ 55.519022] Call Trace: [ 55.519483] <TASK> [ 55.519884] module_put.part.0+0x2a/0x180 [ 55.520642] bpf_prog_free_deferred+0x129/0x2e0 [ 55.521478] process_one_work+0x4fa/0x9e0 [ 55.522122] ? pwq_dec_nr_in_flight+0x100/0x100 [ 55.522878] ? rwlock_bug.part.0+0x60/0x60 [ 55.523551] worker_thread+0x2eb/0x700 [ 55.524176] ? __kthread_parkme+0xd8/0xf0 [ 55.524853] ? process_one_work+0x9e0/0x9e0 [ 55.525544] kthread+0x23a/0x270 [ 55.526088] ? set_kthread_struct+0x80/0x80 [ 55.526798] ret_from_fork+0x1f/0x30 [ 55.527413] </TASK> [ 55.527813] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod] [ 55.530846] CR2: fffffbfff802548b [ 55.531341] ---[ end trace 1af41803c054ad6d ]--- [ 55.532136] RIP: 0010:kasan_check_range+0x184/0x1d0 [ 55.535887] RSP: 0018:ffff88800560fcf0 EFLAGS: 00010282 [ 55.536711] RAX: fffffbfff802548b RBX: fffffbfff802548c RCX: ffffffff9337b6ba [ 55.537821] RDX: fffffbfff802548c RSI: 0000000000000004 RDI: ffffffffc012a458 [ 55.538899] RBP: fffffbfff802548b R08: 0000000000000001 R09: ffffffffc012a45b [ 55.539928] R10: fffffbfff802548b R11: 0000000000000001 R12: ffff888001b5f598 [ 55.541021] R13: ffff888004f49ac8 R14: 0000000000000000 R15: ffff888092449400 [ 55.542108] FS: 0000000000000000(0000) GS:ffff888092400000(0000) knlGS:0000000000000000 [ 55.543260]CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 55.544136] CR2: fffffbfff802548b CR3: 0000000007c10006 CR4: 0000000000770ef0 [ 55.545317] PKRU: 55555554 [ 55.545671] note: kworker/0:2[83] exited with preempt_count 1 Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20220114163953.1455836-11-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
145 lines
3.6 KiB
C
145 lines
3.6 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/* Copyright (c) 2020 Facebook */
|
|
#include <linux/btf.h>
|
|
#include <linux/btf_ids.h>
|
|
#include <linux/error-injection.h>
|
|
#include <linux/init.h>
|
|
#include <linux/module.h>
|
|
#include <linux/percpu-defs.h>
|
|
#include <linux/sysfs.h>
|
|
#include <linux/tracepoint.h>
|
|
#include "bpf_testmod.h"
|
|
|
|
#define CREATE_TRACE_POINTS
|
|
#include "bpf_testmod-events.h"
|
|
|
|
DEFINE_PER_CPU(int, bpf_testmod_ksym_percpu) = 123;
|
|
|
|
noinline void
|
|
bpf_testmod_test_mod_kfunc(int i)
|
|
{
|
|
*(int *)this_cpu_ptr(&bpf_testmod_ksym_percpu) = i;
|
|
}
|
|
|
|
noinline int bpf_testmod_loop_test(int n)
|
|
{
|
|
int i, sum = 0;
|
|
|
|
/* the primary goal of this test is to test LBR. Create a lot of
|
|
* branches in the function, so we can catch it easily.
|
|
*/
|
|
for (i = 0; i < n; i++)
|
|
sum += i;
|
|
return sum;
|
|
}
|
|
|
|
__weak noinline struct file *bpf_testmod_return_ptr(int arg)
|
|
{
|
|
static struct file f = {};
|
|
|
|
switch (arg) {
|
|
case 1: return (void *)EINVAL; /* user addr */
|
|
case 2: return (void *)0xcafe4a11; /* user addr */
|
|
case 3: return (void *)-EINVAL; /* canonical, but invalid */
|
|
case 4: return (void *)(1ull << 60); /* non-canonical and invalid */
|
|
case 5: return (void *)~(1ull << 30); /* trigger extable */
|
|
case 6: return &f; /* valid addr */
|
|
case 7: return (void *)((long)&f | 1); /* kernel tricks */
|
|
default: return NULL;
|
|
}
|
|
}
|
|
|
|
noinline ssize_t
|
|
bpf_testmod_test_read(struct file *file, struct kobject *kobj,
|
|
struct bin_attribute *bin_attr,
|
|
char *buf, loff_t off, size_t len)
|
|
{
|
|
struct bpf_testmod_test_read_ctx ctx = {
|
|
.buf = buf,
|
|
.off = off,
|
|
.len = len,
|
|
};
|
|
int i = 1;
|
|
|
|
while (bpf_testmod_return_ptr(i))
|
|
i++;
|
|
|
|
/* This is always true. Use the check to make sure the compiler
|
|
* doesn't remove bpf_testmod_loop_test.
|
|
*/
|
|
if (bpf_testmod_loop_test(101) > 100)
|
|
trace_bpf_testmod_test_read(current, &ctx);
|
|
|
|
/* Magic number to enable writable tp */
|
|
if (len == 64) {
|
|
struct bpf_testmod_test_writable_ctx writable = {
|
|
.val = 1024,
|
|
};
|
|
trace_bpf_testmod_test_writable_bare(&writable);
|
|
if (writable.early_ret)
|
|
return snprintf(buf, len, "%d\n", writable.val);
|
|
}
|
|
|
|
return -EIO; /* always fail */
|
|
}
|
|
EXPORT_SYMBOL(bpf_testmod_test_read);
|
|
ALLOW_ERROR_INJECTION(bpf_testmod_test_read, ERRNO);
|
|
|
|
noinline ssize_t
|
|
bpf_testmod_test_write(struct file *file, struct kobject *kobj,
|
|
struct bin_attribute *bin_attr,
|
|
char *buf, loff_t off, size_t len)
|
|
{
|
|
struct bpf_testmod_test_write_ctx ctx = {
|
|
.buf = buf,
|
|
.off = off,
|
|
.len = len,
|
|
};
|
|
|
|
trace_bpf_testmod_test_write_bare(current, &ctx);
|
|
|
|
return -EIO; /* always fail */
|
|
}
|
|
EXPORT_SYMBOL(bpf_testmod_test_write);
|
|
ALLOW_ERROR_INJECTION(bpf_testmod_test_write, ERRNO);
|
|
|
|
static struct bin_attribute bin_attr_bpf_testmod_file __ro_after_init = {
|
|
.attr = { .name = "bpf_testmod", .mode = 0666, },
|
|
.read = bpf_testmod_test_read,
|
|
.write = bpf_testmod_test_write,
|
|
};
|
|
|
|
BTF_SET_START(bpf_testmod_check_kfunc_ids)
|
|
BTF_ID(func, bpf_testmod_test_mod_kfunc)
|
|
BTF_SET_END(bpf_testmod_check_kfunc_ids)
|
|
|
|
static const struct btf_kfunc_id_set bpf_testmod_kfunc_set = {
|
|
.owner = THIS_MODULE,
|
|
.check_set = &bpf_testmod_check_kfunc_ids,
|
|
};
|
|
|
|
extern int bpf_fentry_test1(int a);
|
|
|
|
static int bpf_testmod_init(void)
|
|
{
|
|
int ret;
|
|
|
|
ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_CLS, &bpf_testmod_kfunc_set);
|
|
if (ret < 0)
|
|
return ret;
|
|
if (bpf_fentry_test1(0) < 0)
|
|
return -EINVAL;
|
|
return sysfs_create_bin_file(kernel_kobj, &bin_attr_bpf_testmod_file);
|
|
}
|
|
|
|
static void bpf_testmod_exit(void)
|
|
{
|
|
return sysfs_remove_bin_file(kernel_kobj, &bin_attr_bpf_testmod_file);
|
|
}
|
|
|
|
module_init(bpf_testmod_init);
|
|
module_exit(bpf_testmod_exit);
|
|
|
|
MODULE_AUTHOR("Andrii Nakryiko");
|
|
MODULE_DESCRIPTION("BPF selftests module");
|
|
MODULE_LICENSE("Dual BSD/GPL");
|