Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]kprobes: don't call disarm_kprobe() for disabled kprobes[EOL][EOL]The assumption in __disable_kprobe() is wrong, and it could try to disarm[EOL]an already disarmed kprobe and fire the WARN_ONCE() below. [0]  We can[EOL]easily reproduce this issue.[EOL][EOL]1. Write 0 to /sys/kernel/debug/kprobes/enabled.[EOL][EOL]  # echo 0 > /sys/kernel/debug/kprobes/enabled[EOL][EOL]2. Run execsnoop.  At this time, one kprobe is disabled.[EOL][EOL]  # /usr/share/bcc/tools/execsnoop &[EOL]  [1] 2460[EOL]  PCOMM            PID    PPID   RET ARGS[EOL][EOL]  # cat /sys/kernel/debug/kprobes/list[EOL]  ffffffff91345650  r  __x64_sys_execve+0x0    [FTRACE][EOL]  ffffffff91345650  k  __x64_sys_execve+0x0    [DISABLED][FTRACE][EOL][EOL]3. Write 1 to /sys/kernel/debug/kprobes/enabled, which changes[EOL]   kprobes_all_disarmed to false but does not arm the disabled kprobe.[EOL][EOL]  # echo 1 > /sys/kernel/debug/kprobes/enabled[EOL][EOL]  # cat /sys/kernel/debug/kprobes/list[EOL]  ffffffff91345650  r  __x64_sys_execve+0x0    [FTRACE][EOL]  ffffffff91345650  k  __x64_sys_execve+0x0    [DISABLED][FTRACE][EOL][EOL]4. Kill execsnoop, when __disable_kprobe() calls disarm_kprobe() for the[EOL]   disabled kprobe and hits the WARN_ONCE() in __disarm_kprobe_ftrace().[EOL][EOL]  # fg[EOL]  /usr/share/bcc/tools/execsnoop[EOL]  ^C[EOL][EOL]Actually, WARN_ONCE() is fired twice, and __unregister_kprobe_top() misses[EOL]some cleanups and leaves the aggregated kprobe in the hash table.  Then,[EOL]__unregister_trace_kprobe() initialises tk->rp.kp.list and creates an[EOL]infinite loop like this.[EOL][EOL]  aggregated kprobe.list -> kprobe.list -.[EOL]                                     ^     ([EOL)                                     '.__.'EOL][EOL]In this situation, these commands fall into the infinite loop and result[EOL]in RCU stall or soft lockup.[EOL][EOL]  cat /sys/kernel/debug/kprobes/list : show_kprobe_addr() enters into the[EOL]                                       infinite loop with RCU.[EOL][EOL]  /usr/share/bcc/tools/execsnoop : warn_kprobe_rereg() holds kprobe_mutex,[EOL]                                   and __get_valid_kprobe() is stuck in[EOL]\t\t\t\t   the loop.[EOL][EOL]To avoid the issue, make sure we don't call disarm_kprobe() for disabled[EOL]kprobes.[EOL][EOL][0][EOL]Failed to disarm kprobe-ftrace at __x64_sys_execve+0x0/0x40 (error -2)[EOL]WARNING: CPU: 6 PID: 2460 at kernel/kprobes.c:1130 __disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129)[EOL]Modules linked in: ena[EOL]CPU: 6 PID: 2460 Comm: execsnoop Not tainted 5.19.0+ #28[EOL]Hardware name: Amazon EC2 c5.2xlarge/, BIOS 1.0 10/16/2017[EOL]RIP: 0010:__disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129)[EOL]Code: 24 8b 02 eb c1 80 3d c4 83 f2 01 00 75 d4 48 8b 75 00 89 c2 48 c7 c7 90 fa 0f 92 89 04 24 c6 05 ab 83 01 e8 e4 94 f0 ff <0f> 0b 8b 04 24 eb b1 89 c6 48 c7 c7 60 fa 0f 92 89 04 24 e8 cc 94[EOL]RSP: 0018:ffff9e6ec154bd98 EFLAGS: 00010282[EOL]RAX: 0000000000000000 RBX: ffffffff930f7b00 RCX: 0000000000000001[EOL]RDX: 0000000080000001 RSI: ffffffff921461c5 RDI: 00000000ffffffff[EOL]RBP: ffff89c504286da8 R08: 0000000000000000 R09: c0000000fffeffff[EOL]R10: 0000000000000000 R11: ffff9e6ec154bc28 R12: ffff89c502394e40[EOL]R13: ffff89c502394c00 R14: ffff9e6ec154bc00 R15: 0000000000000000[EOL]FS:  00007fe800398740(0000) GS:ffff89c812d80000(0000) knlGS:0000000000000000[EOL]CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[EOL]CR2: 000000c00057f010 CR3: 0000000103b54006 CR4: 00000000007706e0[EOL]DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000[EOL]DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400[EOL]PKRU: 55555554[EOL]Call Trace:[EOL]<TASK>[EOL] __disable_kprobe (kernel/kprobes.c:1716)[EOL] disable_kprobe (kernel/kprobes.c:2392)[EOL] __disable_trace_kprobe (kernel/trace/trace_kprobe.c:340)[EOL] disable_trace_kprobe (kernel/trace/trace_kprobe.c:429)[EOL] perf_trace_event_unreg.isra.2 (./include/linux/tracepoint.h:93 kernel/trace/trace_event_perf.c:168)[EOL] perf_kprobe_destroy (kernel/trace/trace_event_perf.c:295)[EOL] _free_event (kernel/events/core.c:4971)[EOL] perf_event_release_kernel (kernel/events/core.c:5176)[EOL] perf_release (kernel/events/core.c:5186)[EOL] __fput (fs/file_table.c:321)[EOL] task_work_run (./include/linux/[EOL]---truncated---

CREATE(Triage):(User=lchen-cn) [CVE-2022-50008 (https://nvd.nist.gov/vuln/detail/CVE-2022-50008)