In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Clear prog->jited_len along prog->jited
syzbot reported an illegal copytouser() attempt from bpfproggetinfoby_fd() [1]
There was no repro yet on this bug, but I think that commit 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns") is exposing a prior bug in bpf arm64.
bpfproggetinfobyfd() looks at prog->jitedlen to determine if the JIT image can be copied out to user space.
My theory is that syzbot managed to get a prog where prog->jitedlen has been set to 43, while prog->bpffunc has ben cleared.
It is not clear why copytouser(uinsns, NULL, ulen) is triggering this particular warning.
I thought findvmaarea(NULL) would not find a vmstruct. As we do not hold vmaparealock spinlock, it might be possible that the found vmstruct was garbage.
[1] usercopy: Kernel memory exposure attempt detected from vmalloc (offset 792633534417210172, size 43)! kernel BUG at mm/usercopy.c:101! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 25002 Comm: syz-executor.1 Not tainted 5.18.0-syzkaller-10139-g8291eaafed36 #0 Hardware name: linux,dummy-virt (DT) pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usercopyabort+0x90/0x94 mm/usercopy.c:101 lr : usercopyabort+0x90/0x94 mm/usercopy.c:89 sp : ffff80000b773a20 x29: ffff80000b773a30 x28: faff80000b745000 x27: ffff80000b773b48 x26: 0000000000000000 x25: 000000000000002b x24: 0000000000000000 x23: 00000000000000e0 x22: ffff80000b75db67 x21: 0000000000000001 x20: 000000000000002b x19: ffff80000b75db3c x18: 00000000fffffffd x17: 2820636f6c6c616d x16: 76206d6f72662064 x15: 6574636574656420 x14: 74706d6574746120 x13: 2129333420657a69 x12: 73202c3237313031 x11: 3237313434333533 x10: 3336323937207465 x9 : 657275736f707865 x8 : ffff80000a30c550 x7 : ffff80000b773830 x6 : ffff80000b773830 x5 : 0000000000000000 x4 : ffff00007fbbaa10 x3 : 0000000000000000 x2 : 0000000000000000 x1 : f7ff000028fc0000 x0 : 0000000000000064 Call trace: usercopyabort+0x90/0x94 mm/usercopy.c:89 checkheapobject mm/usercopy.c:186 [inline] _checkobjectsize mm/usercopy.c:252 [inline] _checkobjectsize+0x198/0x36c mm/usercopy.c:214 checkobjectsize include/linux/threadinfo.h:199 [inline] checkcopysize include/linux/threadinfo.h:235 [inline] copytouser include/linux/uaccess.h:159 [inline] bpfproggetinfobyfd.isra.0+0xf14/0xfdc kernel/bpf/syscall.c:3993 bpfobjgetinfobyfd+0x12c/0x510 kernel/bpf/syscall.c:4253 _sysbpf+0x900/0x2150 kernel/bpf/syscall.c:4956 _dosysbpf kernel/bpf/syscall.c:5021 [inline] _sesysbpf kernel/bpf/syscall.c:5019 [inline] _arm64sysbpf+0x28/0x40 kernel/bpf/syscall.c:5019 _invokesyscall arch/arm64/kernel/syscall.c:38 [inline] invokesyscall+0x48/0x114 arch/arm64/kernel/syscall.c:52 el0svccommon.constprop.0+0x44/0xec arch/arm64/kernel/syscall.c:142 doel0svc+0xa0/0xc0 arch/arm64/kernel/syscall.c:206 el0svc+0x44/0xb0 arch/arm64/kernel/entry-common.c:624 el0t64synchandler+0x1ac/0x1b0 arch/arm64/kernel/entry-common.c:642 el0t64_sync+0x198/0x19c arch/arm64/kernel/entry.S:581 Code: aa0003e3 d00038c0 91248000 97fff65f (d4210000)
[
{
"signature_type": "Function",
"digest": {
"function_hash": "86423920904459763361584516921307334722",
"length": 2617.0
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c",
"function": "bpf_int_jit_compile"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10f3b29c65bb2fe0d47c2945cd0b4087be1c5218",
"id": "CVE-2022-49341-091ef275",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123954687909413928608297015456111559865",
"17359429240477674202175764723781427912",
"27389317637725804151504183616558934601",
"103873195715168589077123363753589632180"
]
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f4d5e727aeaa610688d46c9f101f78b7f712583",
"id": "CVE-2022-49341-26086325",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123954687909413928608297015456111559865",
"17359429240477674202175764723781427912",
"27389317637725804151504183616558934601",
"103873195715168589077123363753589632180"
]
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c25a3040bc0486c41a7b63a1fb0de7cdb846ad7",
"id": "CVE-2022-49341-2c213bc8",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "286269028776824868625390075243170170682",
"length": 2577.0
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c",
"function": "bpf_int_jit_compile"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f4d5e727aeaa610688d46c9f101f78b7f712583",
"id": "CVE-2022-49341-3c3841e3",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123954687909413928608297015456111559865",
"17359429240477674202175764723781427912",
"27389317637725804151504183616558934601",
"103873195715168589077123363753589632180"
]
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e412b3d178ea4bf746f6b8ee086761613704c6be",
"id": "CVE-2022-49341-4615785b",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "286269028776824868625390075243170170682",
"length": 2577.0
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c",
"function": "bpf_int_jit_compile"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cf7aaff290cdc4d7cee683d4a18138b0dacac48",
"id": "CVE-2022-49341-4b6827fd",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "286269028776824868625390075243170170682",
"length": 2577.0
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c",
"function": "bpf_int_jit_compile"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41f7c4f85d402043687e863627a1a84fa867c62d",
"id": "CVE-2022-49341-554f1ae8",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "166546037993373281689575057937704796342",
"length": 2246.0
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c",
"function": "bpf_int_jit_compile"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaf61a312af63e1cfe2264c4c5b8cd4ea3626025",
"id": "CVE-2022-49341-93d1f5d0",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123954687909413928608297015456111559865",
"17359429240477674202175764723781427912",
"27389317637725804151504183616558934601",
"103873195715168589077123363753589632180"
]
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cf7aaff290cdc4d7cee683d4a18138b0dacac48",
"id": "CVE-2022-49341-b0fe48e2",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123954687909413928608297015456111559865",
"17359429240477674202175764723781427912",
"27389317637725804151504183616558934601",
"103873195715168589077123363753589632180"
]
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaf61a312af63e1cfe2264c4c5b8cd4ea3626025",
"id": "CVE-2022-49341-b87efec4",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123954687909413928608297015456111559865",
"17359429240477674202175764723781427912",
"27389317637725804151504183616558934601",
"103873195715168589077123363753589632180"
]
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41f7c4f85d402043687e863627a1a84fa867c62d",
"id": "CVE-2022-49341-c7d51f0e",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "308208114269972766824761492758162049612",
"length": 2405.0
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c",
"function": "bpf_int_jit_compile"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e412b3d178ea4bf746f6b8ee086761613704c6be",
"id": "CVE-2022-49341-cb7d3193",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "286269028776824868625390075243170170682",
"length": 2577.0
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c",
"function": "bpf_int_jit_compile"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c25a3040bc0486c41a7b63a1fb0de7cdb846ad7",
"id": "CVE-2022-49341-da9ceb5e",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123954687909413928608297015456111559865",
"17359429240477674202175764723781427912",
"27389317637725804151504183616558934601",
"103873195715168589077123363753589632180"
]
},
"target": {
"file": "arch/arm64/net/bpf_jit_comp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10f3b29c65bb2fe0d47c2945cd0b4087be1c5218",
"id": "CVE-2022-49341-dfae39dc",
"deprecated": false,
"signature_version": "v1"
}
]