Daniel Borkmann 9facc33687 bpf: reject any prog that failed read-only lock ... We currently lock any JITed image as read-only via bpf_jit_binary_lock_ro() as well as the BPF image as read-only through bpf_prog_lock_ro(). In the case any of these would fail we throw a WARN_ON_ONCE() in order to yell loudly to the log. Perhaps, to some extend, this may be comparable to an allocation where __GFP_NOWARN is explicitly not set. Added via 65869a47f3 ("bpf: improve read-only handling"), this behavior is slightly different compared to any of the other in-kernel set_memory_ro() users who do not check the return code of set_memory_ro() and friends /at all/ (e.g. in the case of module_enable_ro() / module_disable_ro()). Given in BPF this is mandatory hardening step, we want to know whether there are any issues that would leave both BPF data writable. So it happens that syzkaller enabled fault injection and it triggered memory allocation failure deep inside x86's change_page_attr_set_clr() which was triggered from set_memory_ro(). Now, there are two options: i) leaving everything as is, and ii) reworking the image locking code in order to have a final checkpoint out of the central bpf_prog_select_runtime() which probes whether any of the calls during prog setup weren't successful, and then bailing out with an error. Option ii) is a better approach since this additional paranoia avoids altogether leaving any potential W+X pages from BPF side in the system. Therefore, lets be strict about it, and reject programs in such unlikely occasion. While testing I noticed also that one bpf_prog_lock_ro() call was missing on the outer dummy prog in case of calls, e.g. in the destructor we call bpf_prog_free_deferred() on the main prog where we try to bpf_prog_unlock_free() the program, and since we go via bpf_prog_select_runtime() do that as well. Reported-by: syzbot+3b889862e65a98317058@syzkaller.appspotmail.com Reported-by: syzbot+9e762b52dd17e616a7a5@syzkaller.appspotmail.com Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org>		2018-06-15 11:14:25 -07:00
..
bpf	bpf: reject any prog that failed read-only lock	2018-06-15 11:14:25 -07:00
cgroup	- Introduce arithmetic overflow test helper functions (Rasmus)	2018-06-06 17:27:14 -07:00
configs	KVM changes for 4.16	2018-02-10 13:16:35 -08:00
debug	* Fix 2032 time access issues and new compiler warnings	2018-04-12 10:21:19 -07:00
events	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2018-06-06 18:39:49 -07:00
gcov	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
irq	Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-06-10 09:44:53 -07:00
livepatch	livepatch: Allow to call a custom callback when freeing shadow variables	2018-04-17 13:42:48 +02:00
locking	Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-06-04 16:40:11 -07:00
power	Power management updates for 4.18-rc1	2018-06-05 09:38:39 -07:00
printk	Printk changes for 4.18	2018-06-06 16:04:55 -07:00
rcu	rcu/x86: Provide early rcu_cpu_starting() callback	2018-05-22 16:12:26 -07:00
sched	Merge branch 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-06-10 10:17:09 -07:00
time	Power management updates for 4.18-rc1	2018-06-05 09:38:39 -07:00
trace	powerpc updates for 4.18	2018-06-07 10:23:33 -07:00
.gitignore
acct.c	kernel/acct.c: fix the acct->needcheck check in check_free_space()	2018-01-04 16:45:09 -08:00
async.c	kernel/async.c: revert "async: simplify lowest_in_progress()"	2018-02-06 18:32:44 -08:00
audit_fsnotify.c
audit_tree.c	audit: track the owner of the command mutex ourselves	2018-02-23 11:22:22 -05:00
audit_watch.c	audit: use inline function to get audit context	2018-05-14 17:24:18 -04:00
audit.c	audit: use inline function to get audit context	2018-05-14 17:24:18 -04:00
audit.h	audit: track the owner of the command mutex ourselves	2018-02-23 11:22:22 -05:00
auditfilter.c	audit: use existing session info function	2018-05-18 15:47:54 -04:00
auditsc.c	audit: Fix wrong task in comparison of session ID	2018-05-21 14:27:43 -04:00
backtracetest.c
bounds.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
capability.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
compat.c	Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-06-04 20:27:54 -07:00
configs.c
context_tracking.c
cpu_pm.c
cpu.c	cpu/hotplug: Fix unused function warning	2018-03-15 20:34:40 +01:00
crash_core.c	mm: split page_type out from _mapcount	2018-06-07 17:34:37 -07:00
crash_dump.c
cred.c
delayacct.c	delayacct: Use raw_spinlocks	2018-04-27 14:34:51 +02:00
dma.c	proc: introduce proc_create_single{,_data}	2018-05-16 07:23:35 +02:00
elfcore.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
exec_domain.c	proc: introduce proc_create_single{,_data}	2018-05-16 07:23:35 +02:00
exit.c	kernel: use kernel_wait4() instead of sys_wait4()	2018-04-02 20:14:51 +02:00
extable.c	extable: Make init_kernel_text() global	2018-02-21 16:54:06 +01:00
fail_function.c	error-injection: Fix to prohibit jump optimization	2018-03-12 16:16:00 +01:00
fork.c	Merge branch 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-06-10 10:17:09 -07:00
freezer.c
futex_compat.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
futex.c	pids: introduce find_get_task_by_vpid() helper	2018-02-06 18:32:46 -08:00
groups.c	kernel: make groups_sort calling a responsibility group_info allocators	2017-12-14 16:00:49 -08:00
hung_task.c	kernel/hung_task.c: show all hung tasks before panic	2018-06-07 17:34:39 -07:00
iomem.c	memremap: split devm_memremap_pages() and memremap() infrastructure	2018-05-15 23:08:33 -07:00
irq_work.c	irq/work: Improve the flag definitions	2018-01-08 19:43:15 +01:00
jump_label.c	jump_label: Disable jump labels in __exit code	2018-03-20 08:57:17 +01:00
kallsyms.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk	2018-02-01 13:36:15 -08:00
kcmp.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c	kcov: detect double association with a single task	2018-02-06 18:32:46 -08:00
kexec_core.c
kexec_file.c	kernel/kexec_file.c: allow archs to set purgatory load address	2018-04-13 17:10:28 -07:00
kexec_internal.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
kexec.c	kexec: call do_kexec_load() in compat syscall directly	2018-04-02 20:15:01 +02:00
kmod.c
kprobes.c	kprobes: Fix random address output of blacklist file	2018-04-25 10:27:56 -04:00
ksysfs.c
kthread.c	kthread: Allow kthread_park() on a parked kthread	2018-05-25 08:03:51 +02:00
latencytop.c
Makefile	Merge branch 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-06-10 10:17:09 -07:00
memremap.c	mm: introduce MEMORY_DEVICE_FS_DAX and CONFIG_DEV_PAGEMAP_OPS	2018-05-22 06:59:39 -07:00
module_signing.c
module-internal.h
module.c	- Introduce arithmetic overflow test helper functions (Rasmus)	2018-06-06 17:27:14 -07:00
notifier.c
nsproxy.c
padata.c	padata: add SPDX identifier	2018-01-05 18:43:00 +11:00
panic.c	taint: add taint for randstruct	2018-04-11 10:28:35 -07:00
params.c	kernel/params.c: downgrade warning for unsafe parameters	2018-04-11 10:28:37 -07:00
pid_namespace.c	Merge branch 'userns-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2018-04-03 19:15:32 -07:00
pid.c	xarray: add the xa_lock to the radix_tree_root	2018-04-11 10:28:39 -07:00
profile.c
ptrace.c	pids: introduce find_get_task_by_vpid() helper	2018-02-06 18:32:46 -08:00
range.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
reboot.c	kernel/reboot.c: add devm_register_reboot_notifier()	2017-11-17 16:10:04 -08:00
relay.c	kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE	2018-02-21 15:35:43 -08:00
resource.c	libnvdimm for 4.18	2018-06-08 17:21:52 -07:00
rseq.c	rseq: Introduce restartable sequences system call	2018-06-06 11:58:31 +02:00
seccomp.c	audit/stable-4.18 PR 20180605	2018-06-06 16:34:00 -07:00
signal.c	signal: Remove no longer required irqsave/restore	2018-06-10 06:14:01 +02:00
smp.c	smp/core: Use lockdep to assert IRQs are disabled/enabled	2017-11-08 11:13:50 +01:00
smpboot.c
smpboot.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
softirq.c	Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-06-04 19:59:22 -07:00
stacktrace.c
stop_machine.c	Linux 4.17-rc5	2018-05-15 08:10:50 +02:00
sys_ni.c	Merge branch 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-06-10 10:17:09 -07:00
sys.c	mm: introduce arg_lock to protect arg_start|end and env_start|end in mm_struct	2018-06-07 17:34:34 -07:00
sysctl_binary.c	staging: irda: remove remaining remants of irda code removal	2018-04-16 11:26:49 +02:00
sysctl.c	kernel/sysctl.c: add kdoc comments to do_proc_do{u}intvec_minmax_conv_param	2018-04-11 10:28:38 -07:00
task_work.c	locking/barriers: Convert users of lockless_dereference() to READ_ONCE()	2017-12-17 13:57:15 +01:00
taskstats.c	pids: introduce find_get_task_by_vpid() helper	2018-02-06 18:32:46 -08:00
test_kprobes.c	kprobes: Disable the jprobes test code	2017-10-20 11:02:54 +02:00
torture.c	rcu: Rename cond_resched_rcu_qs() to cond_resched_tasks_rcu_qs()	2018-05-15 10:27:29 -07:00
tracepoint.c	tracepoints: Fix the descriptions of tracepoint_probe_register{_prio}	2018-05-28 12:49:51 -04:00
tsacct.c
ucount.c	headers: untangle kmemleak.h from mm.h	2018-04-05 21:36:27 -07:00
uid16.c	fs: add do_fchownat(), ksys_fchown() helpers and ksys_{,l}chown() wrappers	2018-04-02 20:15:59 +02:00
uid16.h	kernel: provide ksys_*() wrappers for syscalls called by kernel/uid16.c	2018-04-02 20:15:30 +02:00
umh.c	umh: fix race condition	2018-06-07 16:56:28 -04:00
up.c
user_namespace.c	fuse: Restrict allow_other to the superblock's namespace or a descendant	2018-03-20 17:11:44 +01:00
user-return-notifier.c
user.c	efivarfs: Limit the rate for non-root to read files	2018-02-22 10:21:02 -08:00
utsname_sysctl.c
utsname.c	uts: create "struct uts_namespace" from kmem_cache	2018-04-11 10:28:35 -07:00
watchdog_hld.c	Merge branch 'linus' into core/urgent, to pick up dependent commits	2017-11-04 08:53:04 +01:00
watchdog.c	Merge branch 'linus' into sched/core, to pick up fixes	2017-11-08 10:17:15 +01:00
workqueue_internal.h	workqueue: Set worker->desc to workqueue name by default	2018-05-18 08:47:13 -07:00
workqueue.c	SCSI misc on 20180610	2018-06-10 13:01:12 -07:00