remarkable-linux/kernel
Jann Horn 7b6460337e bpf: fix double-fdput in replace_map_fd_with_map_ptr()
[ Upstream commit 8358b02bf6 ]

When bpf(BPF_PROG_LOAD, ...) was invoked with a BPF program whose bytecode
references a non-map file descriptor as a map file descriptor, the error
handling code called fdput() twice instead of once (in __bpf_map_get() and
in replace_map_fd_with_map_ptr()). If the file descriptor table of the
current task is shared, this causes f_count to be decremented too much,
allowing the struct file to be freed while it is still in use
(use-after-free). This can be exploited to gain root privileges by an
unprivileged user.

This bug was introduced in
commit 0246e64d9a ("bpf: handle pseudo BPF_LD_IMM64 insn"), but is only
exploitable since
commit 1be7f75d16 ("bpf: enable non-root eBPF programs") because
previously, CAP_SYS_ADMIN was required to reach the vulnerable code.

(posted publicly according to request by maintainer)

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:22 -04:00
..
bpf bpf: fix double-fdput in replace_map_fd_with_map_ptr() 2016-07-10 23:07:22 -04:00
configs
debug
events perf/core: Disable the event on a truncated AUX record 2016-05-17 13:43:10 -04:00
gcov gcov: fix softlockups 2015-04-17 09:04:08 -04:00
irq genirq: Fix race in register_irq_proc() 2015-10-22 14:43:25 -07:00
livepatch livepatch: add module locking around kallsyms calls 2015-07-21 10:10:04 -07:00
locking locking/ww_mutex: Report recursive ww_mutex locking early 2016-06-17 15:37:42 -04:00
power PM / sleep: Increase default DPM watchdog timeout to 60 2015-08-03 09:29:15 -07:00
printk printk: do cond_resched() between lines while outputting to consoles 2016-02-03 16:23:18 -05:00
rcu rcu: Correctly handle non-empty Tiny RCU callback list with none ready 2015-07-21 10:10:01 -07:00
sched kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while processing sysrq-w 2016-07-10 20:19:56 -04:00
time posix-clock: Fix return code on the poll method's error path 2016-02-01 14:46:08 -05:00
trace tracing: Handle NULL formats in hold_module_trace_bprintk_format() 2016-07-10 20:20:00 -04:00
.gitignore
acct.c acct: check FMODE_CAN_WRITE 2015-04-11 22:27:55 -04:00
async.c
audit.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2015-04-26 17:22:07 -07:00
audit.h Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit 2015-04-22 14:49:23 -07:00
audit_tree.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2015-04-26 17:22:07 -07:00
audit_watch.c VFS: audit: d_backing_inode() annotations 2015-04-15 15:06:55 -04:00
auditfilter.c
auditsc.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2015-04-26 17:22:07 -07:00
backtracetest.c
bounds.c
capability.c kernel: conditionally support non-root users, groups and capabilities 2015-04-15 16:35:22 -07:00
cgroup.c cgroup: make sure a parent css isn't freed before its children 2016-07-10 23:07:11 -04:00
cgroup_freezer.c
compat.c compat: cleanup coding in compat_get_bitmap() and compat_put_bitmap() 2015-06-04 23:57:18 +02:00
configs.c
context_tracking.c context_tracking: Export context_tracking_user_enter/exit 2015-03-09 15:43:00 +01:00
cpu.c Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2015-04-14 13:36:04 -07:00
cpu_pm.c
cpuset.c cpuset: use trialcs->mems_allowed as a temp variable 2015-09-13 09:07:46 -07:00
crash_dump.c
cred.c kernel: conditionally support non-root users, groups and capabilities 2015-04-15 16:35:22 -07:00
delayacct.c
dma.c
elfcore.c
exec_domain.c Remove rest of exec domains. 2015-04-12 21:03:31 +02:00
exit.c wait/ptrace: assume __WALL if the child is traced 2016-06-06 19:12:34 -04:00
extable.c
fork.c unshare: Unsharing a thread does not require unsharing a vm 2015-09-29 19:25:56 +02:00
freezer.c
futex.c futex: Acknowledge a new waiter in counter before plist 2016-07-10 23:07:09 -04:00
futex_compat.c ptrace: use fsuid, fsgid, effective creds for fs access checks 2016-04-11 22:07:35 -04:00
groups.c kernel: conditionally support non-root users, groups and capabilities 2015-04-15 16:35:22 -07:00
hung_task.c kernel/hung_task.c: change hung_task.c to use for_each_process_thread() 2015-04-15 16:35:22 -07:00
irq_work.c
jump_label.c
kallsyms.c
kcmp.c ptrace: use fsuid, fsgid, effective creds for fs access checks 2016-04-11 22:07:35 -04:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kexec.c kexec: allocate the kexec control page with KEXEC_CONTROL_MEMORY_GFP 2015-04-23 16:52:01 +02:00
kmod.c
kprobes.c
ksysfs.c
kthread.c
latencytop.c
Makefile modsign: change default key details 2015-04-30 09:35:41 -07:00
module-internal.h
module.c modules: fix longstanding /proc/kallsyms vs module insertion race. 2016-04-13 17:14:27 -04:00
module_signing.c
notifier.c
nsproxy.c
padata.c
panic.c printk: do cond_resched() between lines while outputting to consoles 2016-02-03 16:23:18 -05:00
params.c params: handle quotes properly for values not of form foo="bar". 2015-04-15 13:31:23 +09:30
pid.c fork: report pid reservation failure properly 2015-04-17 09:04:06 -04:00
pid_namespace.c
profile.c
ptrace.c ptrace: use fsuid, fsgid, effective creds for fs access checks 2016-04-11 22:07:35 -04:00
range.c
reboot.c kernel/reboot.c: add orderly_reboot for graceful reboot 2015-04-15 16:35:23 -07:00
relay.c VFS: kernel/: d_inode() annotations 2015-04-15 15:06:55 -04:00
resource.c kernel/resource.c: fix muxed resource handling in __request_region() 2016-04-13 17:14:25 -04:00
seccomp.c seccomp: always propagate NO_NEW_PRIVS on tsync 2016-02-15 15:45:25 -05:00
signal.c signal: fix information leak in copy_siginfo_from_user32 2015-08-16 20:52:26 -07:00
smp.c smp: Fix error case handling in smp_call_function_*() 2015-04-19 13:19:23 -07:00
smpboot.c smpboot: Add common code for notification from dying CPU 2015-03-11 13:20:25 -07:00
smpboot.h
softirq.c
stacktrace.c
stop_machine.c
sys.c prctl: take mmap sem for writing to protect against others 2016-02-03 16:23:22 -05:00
sys_ni.c kernel: conditionally support non-root users, groups and capabilities 2015-04-15 16:35:22 -07:00
sysctl.c sysctl: Allow creating permanently empty directories that serve as mountpoints. 2015-07-21 10:10:00 -07:00
sysctl_binary.c fs/coredump: prevent fsuid=0 dumps into user-controlled directories 2016-04-18 08:51:07 -04:00
system_certificates.S
system_keyring.c
task_work.c
taskstats.c
test_kprobes.c
torture.c
tracepoint.c
tsacct.c
uid16.c
up.c
user-return-notifier.c
user.c
user_namespace.c
utsname.c
utsname_sysctl.c
watchdog.c watchdog: don't run proc_watchdog_update if new value is same as old 2016-04-18 08:51:01 -04:00
workqueue.c workqueue: fix rebind bound workers warning 2016-05-17 13:43:11 -04:00
workqueue_internal.h