queue-4.14/bpf-do-not-restore-dst_reg-when-cur_state-is-freed.patch

   1 From foo@baz Wed Apr 17 20:59:12 CEST 2019
   2 From: Balbir Singh <sblbir@amzn.com>
   3 Date: Wed, 3 Apr 2019 18:39:15 +0000
   4 Subject: bpf: do not restore dst_reg when cur_state is freed
   5 To: <gregkh@linuxfoundation.org>
   6 Cc: <stable@kernel.org>, <daniel@iogearbox.net>, <jannh@google.com>, <sblbir@amazon.com>, Xu Yu <xuyu@linux.alibaba.com>
   7 Message-ID: <20190403183917.13749-16-sblbir@amzn.com>
   8
   9 From: Xu Yu <xuyu@linux.alibaba.com>
  10
  11 commit 0803278b0b4d8eeb2b461fb698785df65a725d9e upstream.
  12
  13 Syzkaller hit 'KASAN: use-after-free Write in sanitize_ptr_alu' bug.
  14
  15 Call trace:
  16
  17   dump_stack+0xbf/0x12e
  18   print_address_description+0x6a/0x280
  19   kasan_report+0x237/0x360
  20   sanitize_ptr_alu+0x85a/0x8d0
  21   adjust_ptr_min_max_vals+0x8f2/0x1ca0
  22   adjust_reg_min_max_vals+0x8ed/0x22e0
  23   do_check+0x1ca6/0x5d00
  24   bpf_check+0x9ca/0x2570
  25   bpf_prog_load+0xc91/0x1030
  26   __se_sys_bpf+0x61e/0x1f00
  27   do_syscall_64+0xc8/0x550
  28   entry_SYSCALL_64_after_hwframe+0x49/0xbe
  29
  30 Fault injection trace:
  31
  32   kfree+0xea/0x290
  33   free_func_state+0x4a/0x60
  34   free_verifier_state+0x61/0xe0
  35   push_stack+0x216/0x2f0                 <- inject failslab
  36   sanitize_ptr_alu+0x2b1/0x8d0
  37   adjust_ptr_min_max_vals+0x8f2/0x1ca0
  38   adjust_reg_min_max_vals+0x8ed/0x22e0
  39   do_check+0x1ca6/0x5d00
  40   bpf_check+0x9ca/0x2570
  41   bpf_prog_load+0xc91/0x1030
  42   __se_sys_bpf+0x61e/0x1f00
  43   do_syscall_64+0xc8/0x550
  44   entry_SYSCALL_64_after_hwframe+0x49/0xbe
  45
  46 When kzalloc() fails in push_stack(), free_verifier_state() will free
  47 current verifier state. As push_stack() returns, dst_reg was restored
  48 if ptr_is_dst_reg is false. However, as member of the cur_state,
  49 dst_reg is also freed, and error occurs when dereferencing dst_reg.
  50 Simply fix it by testing ret of push_stack() before restoring dst_reg.
  51
  52 Fixes: 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic")
  53 Signed-off-by: Xu Yu <xuyu@linux.alibaba.com>
  54 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
  55 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  56 ---
  57  kernel/bpf/verifier.c |    2 +-
  58  1 file changed, 1 insertion(+), 1 deletion(-)
  59
  60 --- a/kernel/bpf/verifier.c
  61 +++ b/kernel/bpf/verifier.c
  62 @@ -2118,7 +2118,7 @@ do_sim:
  63                 *dst_reg = *ptr_reg;
  64         }
  65         ret = push_stack(env, env->insn_idx + 1, env->insn_idx, true);
  66 -       if (!ptr_is_dst_reg)
  67 +       if (!ptr_is_dst_reg && ret)
  68                 *dst_reg = tmp;
  69         return !ret ? -EFAULT : 0;
  70  }