mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
1,205,369 Commits 103 Branches 4,995 Tags 5.4 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
Go to file
Steven Rostedt (Google) 2c9de867ca tracing: Have trace_event_file have ref counters 
commit bb32500fb9 upstream.

The following can crash the kernel:

 # cd /sys/kernel/tracing
 # echo 'p:sched schedule' > kprobe_events
 # exec 5>>events/kprobes/sched/enable
 # > kprobe_events
 # exec 5>&-

The above commands:

 1. Change directory to the tracefs directory
 2. Create a kprobe event (doesn't matter what one)
 3. Open bash file descriptor 5 on the enable file of the kprobe event
 4. Delete the kprobe event (removes the files too)
 5. Close the bash file descriptor 5

The above causes a crash!

 BUG: kernel NULL pointer dereference, address: 0000000000000028
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: 0000 [#1] PREEMPT SMP PTI
 CPU: 6 PID: 877 Comm: bash Not tainted 6.5.0-rc4-test-00008-g2c6b6b1029d4-dirty #186
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
 RIP: 0010:tracing_release_file_tr+0xc/0x50

What happens here is that the kprobe event creates a trace_event_file
"file" descriptor that represents the file in tracefs to the event. It
maintains state of the event (is it enabled for the given instance?).
Opening the "enable" file gets a reference to the event "file" descriptor
via the open file descriptor. When the kprobe event is deleted, the file is
also deleted from the tracefs system which also frees the event "file"
descriptor.

But as the tracefs file is still opened by user space, it will not be
totally removed until the final dput() is called on it. But this is not
true with the event "file" descriptor that is already freed. If the user
does a write to or simply closes the file descriptor it will reference the
event "file" descriptor that was just freed, causing a use-after-free bug.

To solve this, add a ref count to the event "file" descriptor as well as a
new flag called "FREED". The "file" will not be freed until the last
reference is released. But the FREE flag will be set when the event is
removed to prevent any more modifications to that event from happening,
even if there's still a reference to the event "file" descriptor.

Link: https://lore.kernel.org/linux-trace-kernel/20231031000031.1e705592@gandalf.local.home/
Link: https://lore.kernel.org/linux-trace-kernel/20231031122453.7a48b923@gandalf.local.home

Cc: stable@vger.kernel.org
Cc: Mark Rutland <mark.rutland@arm.com>
Fixes: f5ca233e2e ("tracing: Increase trace array ref count on enable and filter files")
Reported-by: Beau Belgrave <beaub@linux.microsoft.com>
Tested-by: Beau Belgrave <beaub@linux.microsoft.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2023-11-28 17:15:19 +00:00
Documentation torture: Add lock_torture writer_fifo module parameter 2023-11-28 17:15:09 +00:00
LICENSES LICENSES: Add the copyleft-next-0.3.1 license 2022-11-08 15:44:01 +01:00
arch powerpc/powernv: Fix fortify source warnings in opal-prd.c 2023-11-28 17:15:19 +00:00
block blk-mq: make sure active queue usage is held for bio_integrity_prep() 2023-11-28 17:14:55 +00:00
certs KEYS: Add missing function documentation 2023-04-24 16:15:52 +03:00
crypto crypto: pcrypt - Fix hungtask for PADATA_RESET 2023-11-28 17:14:46 +00:00
drivers drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox 2023-11-28 17:15:19 +00:00
fs ext4: fix racy may inline data check in dio write 2023-11-28 17:15:17 +00:00
include tracing: Have trace_event_file have ref counters 2023-11-28 17:15:19 +00:00
init proc: sysctl: prevent aliased sysctls from getting passed to init 2023-11-28 17:15:00 +00:00
io_uring io_uring/fdinfo: remove need for sqpoll lock for thread/pid retrieval 2023-11-28 17:14:56 +00:00
ipc Merge branch 'work.namespace' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2023-02-24 19:20:07 -08:00
kernel tracing: Have trace_event_file have ref counters 2023-11-28 17:15:19 +00:00
lib lib/generic-radix-tree.c: Don't overflow in peek() 2023-11-28 17:14:40 +00:00
mm mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors 2023-11-28 17:15:15 +00:00
net mptcp: fix setsockopt(IP_TOS) subflow locking 2023-11-28 17:15:15 +00:00
rust rust: types: make `Opaque` be `!Unpin` 2023-11-08 14:09:04 +01:00
samples samples/bpf: syscall_tp_user: Fix array out-of-bound access 2023-11-28 17:14:52 +00:00
scripts randstruct: Fix gcc-plugin performance mode to stay in group 2023-11-28 17:14:58 +00:00
security ima: detect changes to the backing overlay file 2023-11-28 17:15:06 +00:00
sound ALSA: hda/realtek: Add quirks for HP Laptops 2023-11-28 17:15:12 +00:00
tools selftests: mptcp: fix fastclose with csum failure 2023-11-28 17:15:15 +00:00
usr initramfs: Encode dependency on KBUILD_BUILD_TIMESTAMP 2023-06-06 17:54:49 +09:00
virt kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add() 2023-09-13 09:53:29 +02:00
.clang-format iommu: Add for_each_group_device() 2023-05-23 08:15:51 +02:00
.cocciconfig
…
.get_maintainer.ignore get_maintainer: add Alan to .get_maintainer.ignore 2022-08-20 15:17:44 -07:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore Revert ".gitignore: ignore *.cover and *.mbx" 2023-07-04 15:05:12 -07:00
.mailmap mailmap: add entries for Simon Horman 2023-08-16 09:53:10 +01:00
.rustfmt.toml rust: add `.rustfmt.toml` 2022-09-28 09:02:20 +02:00
COPYING
…
CREDITS - Address -Wmissing-prototype warnings 2023-06-26 16:43:54 -07:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig
…
MAINTAINERS sound fixes for 6.5 2023-08-25 08:48:14 -07:00
Makefile Linux 6.5.12 2023-11-20 11:57:26 +01:00
README
…

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.