On Tue, Apr 16, 2024 at 10:16:54AM +0800, Zheng Yejian wrote: > commit 325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8 upstream. > > When unloading a module, its state is changing MODULE_STATE_LIVE -> > MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take > a time. `is_module_text_address()` and `__module_text_address()` > works with MODULE_STATE_LIVE and MODULE_STATE_GOING. > If we use `is_module_text_address()` and `__module_text_address()` > separately, there is a chance that the first one is succeeded but the > next one is failed because module->state becomes MODULE_STATE_UNFORMED > between those operations. > > In `check_kprobe_address_safe()`, if the second `__module_text_address()` > is failed, that is ignored because it expected a kernel_text address. > But it may have failed simply because module->state has been changed > to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify > non-exist module text address (use-after-free). > > To fix this problem, we should not use separated `is_module_text_address()` > and `__module_text_address()`, but use only `__module_text_address()` > once and do `try_module_get(module)` which is only available with > MODULE_STATE_LIVE. > > Link: https://lore.kernel.org/all/20240410015802.265220-1-zhengyejian1@xxxxxxxxxx/ > > Fixes: 28f6c37a2910 ("kprobes: Forbid probing on trampoline and BPF code areas") > Cc: stable@xxxxxxxxxxxxxxx > Signed-off-by: Zheng Yejian <zhengyejian1@xxxxxxxxxx> > Signed-off-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx> > [Fix conflict due to lack dependency > commit 223a76b268c9 ("kprobes: Fix coding style issues")] > Signed-off-by: Zheng Yejian <zhengyejian1@xxxxxxxxxx> > --- > kernel/kprobes.c | 18 ++++++++++++------ > 1 file changed, 12 insertions(+), 6 deletions(-) All now queued up, thanks. greg k-h
