| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49402: ftrace: Clean up hash direct_functions on register failures |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ftrace: Clean up hash direct_functions on register failures |
| |
| We see the following GPF when register_ftrace_direct fails: |
| |
| [ ] general protection fault, probably for non-canonical address \ |
| 0x200000000000010: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI |
| [...] |
| [ ] RIP: 0010:ftrace_find_rec_direct+0x53/0x70 |
| [ ] Code: 48 c1 e0 03 48 03 42 08 48 8b 10 31 c0 48 85 d2 74 [...] |
| [ ] RSP: 0018:ffffc9000138bc10 EFLAGS: 00010206 |
| [ ] RAX: 0000000000000000 RBX: ffffffff813e0df0 RCX: 000000000000003b |
| [ ] RDX: 0200000000000000 RSI: 000000000000000c RDI: ffffffff813e0df0 |
| [ ] RBP: ffffffffa00a3000 R08: ffffffff81180ce0 R09: 0000000000000001 |
| [ ] R10: ffffc9000138bc18 R11: 0000000000000001 R12: ffffffff813e0df0 |
| [ ] R13: ffffffff813e0df0 R14: ffff888171b56400 R15: 0000000000000000 |
| [ ] FS: 00007fa9420c7780(0000) GS:ffff888ff6a00000(0000) knlGS:000000000 |
| [ ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| [ ] CR2: 000000000770d000 CR3: 0000000107d50003 CR4: 0000000000370ee0 |
| [ ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 |
| [ ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 |
| [ ] Call Trace: |
| [ ] <TASK> |
| [ ] register_ftrace_direct+0x54/0x290 |
| [ ] ? render_sigset_t+0xa0/0xa0 |
| [ ] bpf_trampoline_update+0x3f5/0x4a0 |
| [ ] ? 0xffffffffa00a3000 |
| [ ] bpf_trampoline_link_prog+0xa9/0x140 |
| [ ] bpf_tracing_prog_attach+0x1dc/0x450 |
| [ ] bpf_raw_tracepoint_open+0x9a/0x1e0 |
| [ ] ? find_held_lock+0x2d/0x90 |
| [ ] ? lock_release+0x150/0x430 |
| [ ] __sys_bpf+0xbd6/0x2700 |
| [ ] ? lock_is_held_type+0xd8/0x130 |
| [ ] __x64_sys_bpf+0x1c/0x20 |
| [ ] do_syscall_64+0x3a/0x80 |
| [ ] entry_SYSCALL_64_after_hwframe+0x44/0xae |
| [ ] RIP: 0033:0x7fa9421defa9 |
| [ ] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 9 f8 [...] |
| [ ] RSP: 002b:00007ffed743bd78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 |
| [ ] RAX: ffffffffffffffda RBX: 00000000069d2480 RCX: 00007fa9421defa9 |
| [ ] RDX: 0000000000000078 RSI: 00007ffed743bd80 RDI: 0000000000000011 |
| [ ] RBP: 00007ffed743be00 R08: 0000000000bb7270 R09: 0000000000000000 |
| [ ] R10: 00000000069da210 R11: 0000000000000246 R12: 0000000000000001 |
| [ ] R13: 00007ffed743c4b0 R14: 00000000069d2480 R15: 0000000000000001 |
| [ ] </TASK> |
| [ ] Modules linked in: klp_vm(OK) |
| [ ] ---[ end trace 0000000000000000 ]--- |
| |
| One way to trigger this is: |
| 1. load a livepatch that patches kernel function xxx; |
| 2. run bpftrace -e 'kfunc:xxx {}', this will fail (expected for now); |
| 3. repeat #2 => gpf. |
| |
| This is because the entry is added to direct_functions, but not removed. |
| Fix this by remove the entry from direct_functions when |
| register_ftrace_direct fails. |
| |
| Also remove the last trailing space from ftrace.c, so we don't have to |
| worry about it anymore. |
| |
| The Linux kernel CVE team has assigned CVE-2022-49402 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.5 with commit 763e34e74bb7d5c316015e2e39fcc8520bfd071c and fixed in 5.10.121 with commit 82c888e51c2176a06f8b4541cf748ee81aac6e7e |
| Issue introduced in 5.5 with commit 763e34e74bb7d5c316015e2e39fcc8520bfd071c and fixed in 5.15.46 with commit cae2978d6907ef2c08b9b15f704e783f7c284713 |
| Issue introduced in 5.5 with commit 763e34e74bb7d5c316015e2e39fcc8520bfd071c and fixed in 5.17.14 with commit 805e87af946d8d2954171361e64d143ff37a441b |
| Issue introduced in 5.5 with commit 763e34e74bb7d5c316015e2e39fcc8520bfd071c and fixed in 5.18.3 with commit a0392833a178cf109a57c2a9d4d531bdfc6cd98f |
| Issue introduced in 5.5 with commit 763e34e74bb7d5c316015e2e39fcc8520bfd071c and fixed in 5.19 with commit 7d54c15cb89a29a5f59e5ffc9ee62e6591769ef1 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49402 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| kernel/trace/ftrace.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/82c888e51c2176a06f8b4541cf748ee81aac6e7e |
| https://git.kernel.org/stable/c/cae2978d6907ef2c08b9b15f704e783f7c284713 |
| https://git.kernel.org/stable/c/805e87af946d8d2954171361e64d143ff37a441b |
| https://git.kernel.org/stable/c/a0392833a178cf109a57c2a9d4d531bdfc6cd98f |
| https://git.kernel.org/stable/c/7d54c15cb89a29a5f59e5ffc9ee62e6591769ef1 |
