Patch "bpf: Ensure correct locking around vulnerable function find_vpid()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Ensure correct locking around vulnerable function find_vpid()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-ensure-correct-locking-around-vulnerable-functio.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit facd366e221c1ad5c618014a5ebbdaa17b1889a5
Author: Lee Jones <lee@xxxxxxxxxx>
Date:   Mon Sep 12 14:38:55 2022 +0100

    bpf: Ensure correct locking around vulnerable function find_vpid()
    
    [ Upstream commit 83c10cc362d91c0d8d25e60779ee52fdbbf3894d ]
    
    The documentation for find_vpid() clearly states:
    
      "Must be called with the tasklist_lock or rcu_read_lock() held."
    
    Presently we do neither for find_vpid() instance in bpf_task_fd_query().
    Add proper rcu_read_lock/unlock() to fix the issue.
    
    Fixes: 41bdc4b40ed6f ("bpf: introduce bpf subcommand BPF_TASK_FD_QUERY")
    Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Acked-by: Yonghong Song <yhs@xxxxxx>
    Link: https://lore.kernel.org/bpf/20220912133855.1218900-1-lee@xxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 99ce46f51889..aea9852f1c22 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -4100,7 +4100,9 @@ static int bpf_task_fd_query(const union bpf_attr *attr,
 	if (attr->task_fd_query.flags != 0)
 		return -EINVAL;
 
+	rcu_read_lock();
 	task = get_pid_task(find_vpid(pid), PIDTYPE_PID);
+	rcu_read_unlock();
 	if (!task)
 		return -ENOENT;