Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead[EOL][EOL]ftrace_startup does not remove ops from ftrace_ops_list when[EOL]ftrace_startup_enable fails:[EOL][EOL]register_ftrace_function[EOL]  ftrace_startup[EOL]    __register_ftrace_function[EOL]      ...[EOL]      add_ftrace_ops(&ftrace_ops_list, ops)[EOL]      ...[EOL]    ...[EOL]    ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1[EOL]    ...[EOL]  return 0 // ops is in the ftrace_ops_list.[EOL][EOL]When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:[EOL]unregister_ftrace_function[EOL]  ftrace_shutdown[EOL]    if (unlikely(ftrace_disabled))[EOL]            return -ENODEV;  // return here, __unregister_ftrace_function is not executed,[EOL]                             // as a result, ops is still in the ftrace_ops_list[EOL]    __unregister_ftrace_function[EOL]    ...[EOL][EOL]If ops is dynamically allocated, it will be free later, in this case,[EOL]is_ftrace_trampoline accesses NULL pointer:[EOL][EOL]is_ftrace_trampoline[EOL]  ftrace_ops_trampoline[EOL]    do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL![EOL][EOL]Syzkaller reports as follows:[EOL][ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b[EOL][ 1203.508039] #PF: supervisor read access in kernel mode[EOL][ 1203.508798] #PF: error_code(0x0000) - not-present page[EOL][ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0[EOL][ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI[EOL][ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G    B   W         5.10.0 #8[EOL][ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014[EOL][ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0[EOL][ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 <48> 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00[EOL][ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246[EOL][ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866[EOL][ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b[EOL][ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07[EOL][ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399[EOL][ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008[EOL][ 1203.525634] FS:  00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000[EOL][ 1203.526801] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[EOL][ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0[EOL][ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000[EOL][ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400[EOL][EOL]Therefore, when ftrace_startup_enable fails, we need to rollback registration[EOL]process and remove ops from ftrace_ops_list.

CREATE(Triage):(User=lchen-cn) [CVE-2022-49977 (https://nvd.nist.gov/vuln/detail/CVE-2022-49977)