mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 08:15:07 -04:00
Code Issues Packages Projects Releases Wiki Activity

bpf: Fix use-after-free on mm_struct in bpf_find_vma()

Browse Source 
bpf_find_vma() reads task->mm and calls mmap_read_trylock(mm) without
holding a reference on the mm. On a foreign task, a concurrent exit_mm()
can free the mm_struct between the lockless read and the trylock,
resulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU.

For the current task, task->mm is stable. For a foreign task, pin the mm
under task->alloc_lock and release it with mmput_async(), mirroring commit
d8e27d2d22 ("bpf: fix mm lifecycle in open-coded task_vma iterator").
Use spin_trylock() instead of get_task_mm() so BPF context does not block
on alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the
foreign-task path because dropping the mm reference is not safe there.

Race:

  CPU0 (BPF program)                  CPU1 (exiting task)
  ============================        ==========================
  bpf_find_vma(foreign_task):
    mm = task->mm
                                      exit_mm():
                                        task->mm = NULL
                                        mmput(mm) -> frees mm_struct
    mmap_read_trylock(mm)
        // UAF on mm

Fixes: 7c7e3d31e7 ("bpf: Introduce helper bpf_find_vma")
Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
Reviewed-by: Puranjay Mohan <puranjay@kernel.org>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/bpf/20260708072106.199637-2-sanghyun.park.cnu@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
This commit is contained in:
Sanghyun Park
2026-07-08 16:21:04 +09:00
committed by Kumar Kartikeya Dwivedi
parent e318f9dd8b
commit 47b079e211
1 changed files with 33 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
kernel/bpf/task_iter.c
View File

@@ -756,6 +756,7 @@ BPF_CALL_5(bpf_find_vma, struct task_struct *, task, u64, start,
struct mmap_unlock_irq_work *work = NULL;
struct vm_area_struct *vma;
bool irq_work_busy = false;
bool __maybe_unused mmput_needed = false;
struct mm_struct *mm;
int ret = -ENOENT;
@@ -765,14 +766,38 @@ BPF_CALL_5(bpf_find_vma, struct task_struct *, task, u64, start,
if (!task)
return -ENOENT;
mm = task->mm;
if (task == current) {
mm = task->mm;
} else {
/*
* Foreign task: pin task->mm against a concurrent exit_mm().
* Use trylock on alloc_lock instead of get_task_mm()'s
* blocking task_lock() to avoid deadlocking the target task.
*/
if (!IS_ENABLED(CONFIG_MMU))
return -EOPNOTSUPP;
if (irqs_disabled())
return -EBUSY;
if (!spin_trylock(&task->alloc_lock))
return -EBUSY;
mm = task->mm;
if (mm && !(task->flags & PF_KTHREAD)) {
mmget(mm);
mmput_needed = true;
} else {
mm = NULL;
}
spin_unlock(&task->alloc_lock);
}
if (!mm)
return -ENOENT;
irq_work_busy = bpf_mmap_unlock_get_irq_work(&work);
if (irq_work_busy || !mmap_read_trylock(mm))
return -EBUSY;
if (irq_work_busy || !mmap_read_trylock(mm)) {
ret = -EBUSY;
goto out;
}
vma = find_vma(mm, start);
@@ -782,6 +807,11 @@ BPF_CALL_5(bpf_find_vma, struct task_struct *, task, u64, start,
ret = 0;
}
bpf_mmap_unlock_mm(work, mm);
out:
#ifdef CONFIG_MMU
if (mmput_needed)
mmput_async(mm);
#endif
return ret;
}