[PATCH bpf-next 0/2] bpf: Fix two trampoline image UAFs in bpf_trampoline_multi_detach()

[Hui Zhu]

From: Hui Zhu <zhuhui@xxxxxxxxxx>

While auditing the error paths added by commit aef4dfa790b2 ("bpf: Add
bpf_trampoline_multi_attach/detach functions"), I found two independent
ways bpf_trampoline_multi_detach() can free a trampoline image that
ftrace is still actively calling into.

Patch 1 fixes the case where __bpf_trampoline_unlink_prog() itself
fails before touching ftrace (e.g. -ENOMEM building the new image):
cur_image is left equal to old_image, but
bpf_trampoline_multi_attach_free() frees old_image unconditionally.

Patch 2 fixes the narrower case where the per-trampoline unlink
succeeds (cur_image has already been speculatively advanced) but the
later batched update_ftrace_direct_del()/update_ftrace_direct_mod()
call fails. Patch 1's old_image != cur_image check alone isn't enough
here since ftrace was never actually updated; the affected
trampolines need to be rolled back to old_image instead of freed.

Both paths are already WARN_ON_ONCE()'d and need an allocation or
ftrace failure to trigger, so they're unlikely to fire in practice,
but when they do, the current code frees a live image out from under
ftrace.

Hui Zhu (2):
  bpf: Fix stale old_image UAF on trampoline update failure
  bpf: Fix UAF in bpf_trampoline_multi_detach when ftrace update fails

 kernel/bpf/trampoline.c | 54 +++++++++++++++++++++++++++++++++++------
 1 file changed, 46 insertions(+), 8 deletions(-)

-- 
2.43.0