lkml.org 
[lkml]   [2016]   [May]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.2.y-ckt 40/53] bpf: fix double-fdput in replace_map_fd_with_map_ptr()
    Date
    4.2.8-ckt11 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: Jann Horn <jannh@google.com>

    [ Upstream commit 8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7 ]

    When bpf(BPF_PROG_LOAD, ...) was invoked with a BPF program whose bytecode
    references a non-map file descriptor as a map file descriptor, the error
    handling code called fdput() twice instead of once (in __bpf_map_get() and
    in replace_map_fd_with_map_ptr()). If the file descriptor table of the
    current task is shared, this causes f_count to be decremented too much,
    allowing the struct file to be freed while it is still in use
    (use-after-free). This can be exploited to gain root privileges by an
    unprivileged user.

    This bug was introduced in
    commit 0246e64d9a5f ("bpf: handle pseudo BPF_LD_IMM64 insn"), but is only
    exploitable since
    commit 1be7f75d1668 ("bpf: enable non-root eBPF programs") because
    previously, CAP_SYS_ADMIN was required to reach the vulnerable code.

    (posted publicly according to request by maintainer)

    Signed-off-by: Jann Horn <jannh@google.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Acked-by: Alexei Starovoitov <ast@kernel.org>
    Acked-by: Daniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    kernel/bpf/verifier.c | 1 -
    1 file changed, 1 deletion(-)

    diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
    index b1f68c2..9718319 100644
    --- a/kernel/bpf/verifier.c
    +++ b/kernel/bpf/verifier.c
    @@ -1896,7 +1896,6 @@ static int replace_map_fd_with_map_ptr(struct verifier_env *env)
    if (IS_ERR(map)) {
    verbose("fd %d is not pointing to valid bpf_map\n",
    insn->imm);
    - fdput(f);
    return PTR_ERR(map);
    }

    --
    2.7.4
    \
     
     \ /
      Last update: 2016-05-24 20:21    [W:3.387 / U:0.272 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site