[PATCH] bpf: Fix use-after-free in __bpf_trace_run()

[Qing Wang]

A use-after-free issue reported from syzbot exists in __bpf_trace_run(O).

BUG: KASAN: slab-use-after-free in __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline]
    -> struct bpf_prog *prog = link->link.prog;

The link(struct bpf_raw_tp_link) was freed when link->link.prog.

The root cause is that: both bpf_raw_tp_link and tp_probes are RCU-managed,
but there is no synchronization between their lifecycles. The link can be
freed via call_rcu() before tp_probes is freed via
call_srcu()/call_rcu_tasks_trace(), causing the link's lifetime to be
shorter than tp_probes. This allows __bpf_trace_run() to access the freed
link when a tracepoint fires.

Fix by calling tracepoint_synchronize_unregister() to ensure tp_probes
is freed before allowing the link to be freed.

The issue was introduced by commit d4dfc5700e86 ("bpf:
pass whole link instead of prog when triggering raw tracepoint"),
which changed tracepoint callbacks to receive bpf_raw_tp_link pointers
instead of bpf_prog pointers.

Prior to this commit, this issue did not occur because the bpf_prog was
directly used and protected by reference counting.

Fixes: d4dfc5700e86 ("bpf: pass whole link instead of prog when triggering raw tracepoint")
Reported-by: syzbot+b4c5ad098c821bf8d8bc@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=b4c5ad098c821bf8d8bc
Tested-by: syzbot+b4c5ad098c821bf8d8bc@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Qing Wang <wangqing7171@xxxxxxxxx>
---
 kernel/bpf/syscall.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 0378e83b4099..fc93dd544162 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3783,6 +3783,12 @@ static void bpf_raw_tp_link_release(struct bpf_link *link)
 
 	bpf_probe_unregister(raw_tp->btp, raw_tp);
 	bpf_put_raw_tracepoint(raw_tp->btp);
+
+	/*
+	 * Ensure tp_probes is freed before the link. This prevents
+	 * use-after-free in __bpf_trace_run() when a tracepoint fires.
+	 */
+	tracepoint_synchronize_unregister();
 }
 
 static void bpf_raw_tp_link_dealloc(struct bpf_link *link)
-- 
2.34.1