History

alloc_tag: fix use-after-free in /proc/allocinfo after module unload

allocinfo_start() only reinitializes the codetag iterator at position 0. For subsequent reads (position > 0), it reuses cached iterator state from the previous batch. allocinfo_stop() drops mod_lock between read batches, which allows module unload to complete and free the module memory that the cached iterator still references: CPU0 (read) CPU1 (rmmod) ---- ---- allocinfo_start(pos=0) down_read(mod_lock) allocinfo_show() ... allocinfo_stop() up_read(mod_lock) codetag_unload_module() kfree(cmod) release_module_tags() ... free_mod_mem() allocinfo_start(pos=N) down_read(mod_lock) // reuses cached iter, skips re-init allocinfo_show() ct->filename <-- UAF After free_mod_mem() frees the module's .rodata, allocinfo_show() dereferences ct->filename, ct->function which point there. Save the iterator state in allocinfo_next() and resume from it in allocinfo_start() with codetag_next_ct(), which detects module removal via idr_find() returning NULL and skips to the next module.

Hao Ge committed 5 months ago

Commit 29562681 parent 0c3a3501 file · +7 −2Browse files

Unified · Split

lib/alloc_tag.c+7−2
@@ -45,6 +45,7 @@ int alloc_tag_ref_offs; · 44 unmodified lines
45 45
46struct allocinfo_private {46struct allocinfo_private {
47 struct codetag_iterator iter;47 struct codetag_iterator iter;
48 struct codetag_iterator reported_iter;
48 bool print_header;49 bool print_header;
49};50};
50 51
@@ -58,16 +59,20 @@ static void *allocinfo_start(struct seq_file *m, loff_t *pos) · 7 unmodified lines
58 if (node == 0) {59 if (node == 0) {
59 priv->print_header = true;60 priv->print_header = true;
60 priv->iter = codetag_get_ct_iter(alloc_tag_cttype);61 priv->iter = codetag_get_ct_iter(alloc_tag_cttype);
61 codetag_next_ct(&priv->iter);62 } else {
63 priv->iter = priv->reported_iter;
62 }64 }
65 codetag_next_ct(&priv->iter);
63 return priv->iter.ct ? priv : NULL;66 return priv->iter.ct ? priv : NULL;
64}67}
65 68
66static void *allocinfo_next(struct seq_file *m, void *arg, loff_t *pos)69static void *allocinfo_next(struct seq_file *m, void *arg, loff_t *pos)
67{70{
68 struct allocinfo_private *priv = (struct allocinfo_private *)arg;71 struct allocinfo_private *priv = (struct allocinfo_private *)arg;
69 struct codetag *ct = codetag_next_ct(&priv->iter);72 struct codetag *ct;
70 73
74 priv->reported_iter = priv->iter;
75 ct = codetag_next_ct(&priv->iter);
71 (*pos)++;76 (*pos)++;
72 if (!ct)77 if (!ct)
73 return NULL;78 return NULL;