> On May 15, 2023, at 1:17 PM, Daniel Borkmann <daniel@xxxxxxxxxxxxx> wrote: > > On 5/15/23 5:52 PM, Song Liu wrote: >> On Mon, May 15, 2023 at 6:09 AM Yafang Shao <laoar.shao@xxxxxxxxx> wrote: >>> >>> If it fails to attach fentry, the allocated bpf trampoline image will be >>> left in the system. That can be verified by checking /proc/kallsyms. >>> >>> This meamleak can be verified by a simple bpf program as follows, >>> >>> SEC("fentry/trap_init") >>> int fentry_run() >>> { >>> return 0; >>> } >>> >>> It will fail to attach trap_init because this function is freed after >>> kernel init, and then we can find the trampoline image is left in the >>> system by checking /proc/kallsyms. >>> $ tail /proc/kallsyms >>> ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf] >>> ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf] >>> >>> $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'" >>> [2522] FUNC 'trap_init' type_id=119 linkage=static >>> >>> $ echo $((6442453466 & 0x7fffffff)) >>> 2522 >>> >>> Note that there are two left bpf trampoline images, that is because the >>> libbpf will fallback to raw tracepoint if -EINVAL is returned. >>> >>> Fixes: e21aa341785c ("bpf: Fix fexit trampoline.") >>> Signed-off-by: Yafang Shao <laoar.shao@xxxxxxxxx> >>> Cc: Song Liu <song@xxxxxxxxxx> >>> Cc: Jiri Olsa <olsajiri@xxxxxxxxx> >> Acked-by: Song Liu <song@xxxxxxxxxx> > > Won't this trigger a UAF for the case when progs are already running at > this address aka modify_fentry() fails where you would then also hit the > goto out_free path? This looks not correct to me. I am not following. If modify_fentry() fails, we will not use the new image anywhere, no? Did I miss something? Thanks, Song