linux/kernel
Lee Jones ed403bcd97 bpf: Ensure correct locking around vulnerable function find_vpid()
[ Upstream commit 83c10cc362 ]

The documentation for find_vpid() clearly states:

  "Must be called with the tasklist_lock or rcu_read_lock() held."

Presently we do neither for find_vpid() instance in bpf_task_fd_query().
Add proper rcu_read_lock/unlock() to fix the issue.

Fixes: 41bdc4b40e ("bpf: introduce bpf subcommand BPF_TASK_FD_QUERY")
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20220912133855.1218900-1-lee@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-26 13:25:21 +02:00
..
bpf bpf: Ensure correct locking around vulnerable function find_vpid() 2022-10-26 13:25:21 +02:00
cgroup cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() 2022-09-23 14:17:00 +02:00
configs
debug lockdown: also lock down previous kgdb use 2022-05-30 09:33:22 +02:00
dma swiotlb: max mapping size takes min align mask into account 2022-10-05 10:38:40 +02:00
entry KVM: rseq: Update rseq when processing NOTIFY_RESUME on xfer to KVM guest 2021-10-06 15:55:49 +02:00
events perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() 2022-07-29 17:19:11 +02:00
gcov
irq genirq: GENERIC_IRQ_IPI depends on SMP 2022-08-21 15:15:28 +02:00
kcsan
livepatch livepatch: fix race between fork and KLP transition 2022-10-26 13:25:14 +02:00
locking locking/lockdep: Fix lockdep_init_map_*() confusion 2022-08-21 15:15:33 +02:00
power PM: hibernate: defer device probing when resuming from hibernation 2022-08-21 15:15:31 +02:00
printk printk: fix return value of printk.devkmsg __setup handler 2022-04-08 14:40:08 +02:00
rcu rcu: Make TASKS_RUDE_RCU select IRQ_WORK 2022-06-09 10:20:51 +02:00
sched sched/fair: Fix fault in reweight_entity 2022-08-21 15:16:26 +02:00
time timekeeping: contribute wall clock to rng on time change 2022-08-21 15:16:20 +02:00
trace tracing: Disable interrupt or preemption before acquiring arch_spinlock_t 2022-10-26 13:25:15 +02:00
.gitignore
acct.c
async.c Revert "module, async: async_synchronize_full() on module init iff async is used" 2022-02-23 12:01:00 +01:00
audit_fsnotify.c audit: fix potential double free on error path from fsnotify_add_inode_mark 2022-08-31 17:15:13 +02:00
audit_tree.c audit: move put_tree() to avoid trim_trees refcount underflow and UAF 2021-09-03 10:09:31 +02:00
audit_watch.c
audit.c audit: improve audit queue handling when "audit=1" on cmdline 2022-02-08 18:30:34 +01:00
audit.h audit: log AUDIT_TIME_* records only from rules 2022-04-08 14:40:00 +02:00
auditfilter.c
auditsc.c audit: log AUDIT_TIME_* records only from rules 2022-04-08 14:40:00 +02:00
backtracetest.c
bounds.c
capability.c
compat.c
configs.c
context_tracking.c
cpu_pm.c PM: cpu: Make notifier chain use a raw_spinlock_t 2021-09-15 09:50:40 +02:00
cpu.c random: clear fast pool, crng, and batches in cpuhp bring up 2022-05-30 09:33:36 +02:00
crash_core.c
crash_dump.c
cred.c Revert "Add a reference to ucounts for each cred" 2021-09-08 08:49:00 +02:00
delayacct.c
dma.c
exec_domain.c
exit.c fix race between exit_itimers() and /proc/pid/timers 2022-07-21 21:19:59 +02:00
extable.c
fail_function.c
fork.c IB/core: Fix a nested dead lock as part of ODP flow 2022-09-15 11:32:05 +02:00
freezer.c
futex.c
gen_kheaders.sh
groups.c
hung_task.c
iomem.c
irq_work.c
jump_label.c jump_label: Fix jump_label_text_reserved() vs __init 2021-07-20 16:05:58 +02:00
kallsyms.c
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c
kexec_core.c
kexec_elf.c
kexec_file.c ima: force signature verification when CONFIG_KEXEC_SIG is configured 2022-07-21 21:20:11 +02:00
kexec_internal.h
kexec.c
kheaders.c
kmod.c
kprobes.c kprobes: Prohibit probes in gate area 2022-09-15 11:32:03 +02:00
ksysfs.c
kthread.c kthread: Fix PF_KTHREAD vs to_kthread() race 2021-09-03 10:09:31 +02:00
latencytop.c
Makefile
module_signature.c
module_signing.c
module-internal.h
module.c module: check for exit sections in layout_sections() instead of module_init_section() 2022-05-25 09:18:02 +02:00
notifier.c
nsproxy.c
padata.c
panic.c
params.c
pid_namespace.c memcg: enable accounting for pids in nested pid namespaces 2021-09-18 13:40:36 +02:00
pid.c
profile.c profiling: fix shift too large makes kernel panic 2022-08-21 15:16:05 +02:00
ptrace.c ptrace: Reimplement PTRACE_KILL by always sending SIGKILL 2022-06-09 10:20:49 +02:00
range.c
reboot.c
regset.c
relay.c
resource.c
rseq.c rseq: Remove broken uapi field layout on 32-bit little endian 2022-04-08 14:40:03 +02:00
scftorture.c scftorture: Fix distribution of short handler delays 2022-06-09 10:21:01 +02:00
scs.c
seccomp.c seccomp: Fix setting loaded filter count during TSYNC 2021-08-18 08:59:06 +02:00
signal.c signal handling: don't use BUG_ON() for debugging 2022-07-21 21:20:18 +02:00
smp.c smp: Fix offline cpu check in flush_smp_call_function_queue() 2022-04-20 09:23:29 +02:00
smpboot.c
smpboot.h
softirq.c
stackleak.c gcc-plugins/stackleak: Use noinstr in favor of notrace 2022-02-23 12:01:00 +01:00
stacktrace.c
static_call.c static_call: Fix unused variable warn w/o MODULE 2021-09-08 08:49:00 +02:00
stop_machine.c
sys_ni.c kernel/sys_ni: add compat entry for fadvise64_64 2022-08-31 17:15:13 +02:00
sys.c prctl: allow to setup brk for et_dyn executables 2021-09-26 14:08:57 +02:00
sysctl-test.c
sysctl.c mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE 2022-07-21 21:20:13 +02:00
task_work.c
taskstats.c
test_kprobes.c
torture.c
tracepoint.c tracepoint: Use rcu get state and cond sync for static call updates 2021-09-03 10:09:30 +02:00
tsacct.c taskstats: Cleanup the use of task->exit_code 2022-01-27 10:54:33 +01:00
ucount.c Revert "Add a reference to ucounts for each cred" 2021-09-08 08:49:00 +02:00
uid16.c
uid16.h
umh.c
up.c
user_namespace.c Revert "Add a reference to ucounts for each cred" 2021-09-08 08:49:00 +02:00
user-return-notifier.c
user.c
usermode_driver.c
utsname_sysctl.c
utsname.c
watch_queue.c watch_queue: Fix missing locking in add_watch_to_object() 2022-08-03 12:00:44 +02:00
watchdog_hld.c
watchdog.c watchdog: export lockup_detector_reconfigure 2022-08-25 11:38:20 +02:00
workqueue_internal.h
workqueue.c workqueue: don't skip lockdep work dependency in cancel_work_sync() 2022-09-28 11:10:40 +02:00