mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 08:15:07 -04:00
Code Issues Packages Projects Releases Wiki Activity

bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure

Browse Source 
When bpf_trampoline_update() fails before modify_fentry_multi()/
unregister_fentry_multi() is called, cur_image is unchanged
(cur_image == old_image) and ftrace still calls into it.  Freeing
old_image in that case causes a UAF.

Only free old_image when it differs from cur_image.

Fixes: aef4dfa790 ("bpf: Add bpf_trampoline_multi_attach/detach functions")
Signed-off-by: Hui Zhu <zhuhui@kylinos.cn>
Acked-by: Leon Hwang <leon.hwang@linux.dev>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/bpf/aaa3829e11e2e26bcd3bda9ee6df7a0101a718ac.1786412280.git.zhuhui@kylinos.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
This commit is contained in:
Hui Zhu
2026-08-11 10:46:19 +08:00
committed by Kumar Kartikeya Dwivedi
parent df2175350e
commit 0253073fb7
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
kernel/bpf/trampoline.c
View File

@@ -1632,7 +1632,17 @@ static void bpf_trampoline_multi_attach_init(struct bpf_trampoline *tr)
static void bpf_trampoline_multi_attach_free(struct bpf_trampoline *tr)
{
if (tr->multi_attach.old_image)
/*
* Only free old_image if it is no longer the active image.
* When bpf_trampoline_update() fails before modify_fentry_multi()/
* unregister_fentry_multi() is called, cur_image is unchanged
* (cur_image == old_image) and ftrace still points to it. Freeing
* it would cause a UAF when ftrace calls into the freed memory.
* On success, cur_image is either a new image or NULL, so
* old_image != cur_image means the image is stale.
*/
if (tr->multi_attach.old_image &&
tr->multi_attach.old_image != tr->cur_image)
bpf_tramp_image_put(tr->multi_attach.old_image);
tr->multi_attach.old_image = NULL;