Patch "bpf: Ensure correct locking around vulnerable function find_vpid()" has been added to the 4.19-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Ensure correct locking around vulnerable function find_vpid()

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-ensure-correct-locking-around-vulnerable-functio.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 55c3965e2e7b1ce786c646cc7680a622afa6a433
Author: Lee Jones <lee@xxxxxxxxxx>
Date:   Mon Sep 12 14:38:55 2022 +0100

    bpf: Ensure correct locking around vulnerable function find_vpid()
    
    [ Upstream commit 83c10cc362d91c0d8d25e60779ee52fdbbf3894d ]
    
    The documentation for find_vpid() clearly states:
    
      "Must be called with the tasklist_lock or rcu_read_lock() held."
    
    Presently we do neither for find_vpid() instance in bpf_task_fd_query().
    Add proper rcu_read_lock/unlock() to fix the issue.
    
    Fixes: 41bdc4b40ed6f ("bpf: introduce bpf subcommand BPF_TASK_FD_QUERY")
    Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Acked-by: Yonghong Song <yhs@xxxxxx>
    Link: https://lore.kernel.org/bpf/20220912133855.1218900-1-lee@xxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index e940c1f65938..02e5bdb82a9a 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2325,7 +2325,9 @@ static int bpf_task_fd_query(const union bpf_attr *attr,
 	if (attr->task_fd_query.flags != 0)
 		return -EINVAL;
 
+	rcu_read_lock();
 	task = get_pid_task(find_vpid(pid), PIDTYPE_PID);
+	rcu_read_unlock();
 	if (!task)
 		return -ENOENT;