[GIT PULL] probes: Fixes for v6.12-rc1

[Google]

Hi Linus,

Probes fixes for v6.12-rc1:

 - uprobes: fix kernel info leak via "[uprobes]" vma
   Fix uprobes not to expose the uninitialized page for trampoline
   buffer to user space, which can leak kernel info.


Please pull the latest probes-fixes-v6.12-rc1 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
probes-fixes-v6.12-rc1

Tag SHA1: ee48a9b9cc6cb804d0a49359b8d85290020b72e2
Head SHA1: 34820304cc2cd1804ee1f8f3504ec77813d29c8e


Oleg Nesterov (1):
      uprobes: fix kernel info leak via "[uprobes]" vma

----
 kernel/events/uprobes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
---------------------------
commit 34820304cc2cd1804ee1f8f3504ec77813d29c8e
Author: Oleg Nesterov <oleg@xxxxxxxxxx>
Date:   Sun Sep 29 18:20:47 2024 +0200

    uprobes: fix kernel info leak via "[uprobes]" vma
    
    xol_add_vma() maps the uninitialized page allocated by __create_xol_area()
    into userspace. On some architectures (x86) this memory is readable even
    without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ,
    although this doesn't really matter, debugger can read this memory anyway.
    
    Link: https://lore.kernel.org/all/20240929162047.GA12611@xxxxxxxxxx/
    
    Reported-by: Will Deacon <will@xxxxxxxxxx>
    Fixes: d4b3b6384f98 ("uprobes/core: Allocate XOL slots for uprobes use")
    Cc: stable@xxxxxxxxxxxxxxx
    Acked-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
    Signed-off-by: Oleg Nesterov <oleg@xxxxxxxxxx>
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 2ec796e2f055..4b52cb2ae6d6 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1545,7 +1545,7 @@ static struct xol_area *__create_xol_area(unsigned long vaddr)
 	if (!area->bitmap)
 		goto free_area;
 
-	area->page = alloc_page(GFP_HIGHUSER);
+	area->page = alloc_page(GFP_HIGHUSER | __GFP_ZERO);
 	if (!area->page)
 		goto free_bitmap;
 

-- 
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>