6.11-stable patches

added patches:
	bpf-fix-use-after-free-in-bpf_uprobe_multi_link_attach.patch

diff --git a/queue-6.11/bpf-fix-use-after-free-in-bpf_uprobe_multi_link_attach.patch b/queue-6.11/bpf-fix-use-after-free-in-bpf_uprobe_multi_link_attach.patch
new file mode 100644 (file)
index 0000000..e00779b
--- /dev/null
+++ b/queue-6.11/bpf-fix-use-after-free-in-bpf_uprobe_multi_link_attach.patch
@@ -0,0 +1,57 @@
+From 69238e2134d57bd7d55c02e1e19fcea75121f21c Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Thu, 19 Sep 2024 15:28:53 +0200
+Subject: bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 5fe6e308abaea082c20fbf2aa5df8e14495622cf upstream.
+
+If bpf_link_prime() fails, bpf_uprobe_multi_link_attach() goes to the
+error_free label and frees the array of bpf_uprobe's without calling
+bpf_uprobe_unregister().
+
+This leaks bpf_uprobe->uprobe and worse, this frees bpf_uprobe->consumer
+without removing it from the uprobe->consumers list.
+
+Fixes: 89ae89f53d20 ("bpf: Add multi uprobe link")
+Closes: https://lore.kernel.org/all/000000000000382d39061f59f2dd@google.com/
+Reported-by: syzbot+f7a1c2c2711e4a780f19@syzkaller.appspotmail.com
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: syzbot+f7a1c2c2711e4a780f19@syzkaller.appspotmail.com
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240813152524.GA7292@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/bpf_trace.c |    9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -3487,17 +3487,20 @@ int bpf_uprobe_multi_link_attach(const u
+                                            uprobes[i].ref_ctr_offset,
+                                            &uprobes[i].consumer);
+               if (err) {
+-                      bpf_uprobe_unregister(&path, uprobes, i);
+-                      goto error_free;
++                      link->cnt = i;
++                      goto error_unregister;
+               }
+       }
+ 
+       err = bpf_link_prime(&link->link, &link_primer);
+       if (err)
+-              goto error_free;
++              goto error_unregister;
+ 
+       return bpf_link_settle(&link_primer);
+ 
++error_unregister:
++      bpf_uprobe_unregister(&path, uprobes, link->cnt);
++
+ error_free:
+       kvfree(uprobes);
+       kfree(link);

diff --git a/queue-6.11/series b/queue-6.11/series
index d5692f02f2e9792db81be91fa29cc29a58f71704..181702f5200726d8096beff4a3cabf6e61baf31e 100644 (file)
--- a/queue-6.11/series
+++ b/queue-6.11/series
@@ -692,3 +692,4 @@ i2c-aspeed-update-the-stop-sw-state-when-the-bus-recovery-occurs.patch
 i2c-isch-add-missed-else.patch
 i2c-xiic-try-re-initialization-on-bus-busy-timeout.patch
 documentation-kvm-fix-warning-in-make-htmldocs.patch
+bpf-fix-use-after-free-in-bpf_uprobe_multi_link_attach.patch