Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in arena_vm_close on fork arena_vm_open() only bumps vml->mmap_count but never registers the child VMA in arena->vma_list. The vml->vma always points at the parent VMA, so after parent munmap the pointer dangles. If the child then calls bpf_arena_free_pages(), zap_pages() reads the stale vml->vma triggering use-after-free. Fix this by preventing the arena VMA from being inherited across fork with VM_DONTCOPY, and preventing VMA splits via the may_split callback. Also reject mremap with a .mremap callback returning -EINVAL. A same-size mremap(MREMAP_FIXED) on the full arena VMA reaches copy_vma() through the following path: check_prep_vma() - returns 0 early: new_len == old_len skips VM_DONTEXPAND check prep_move_vma() - vm_start == old_addr and vm_end == old_addr + old_len so may_split is never called move_vma() copy_vma_and_data() copy_vma() vm_area_dup() - copies vm_private_data (vml pointer) vm_ops->open() - bumps vml->mmap_count vm_ops->mremap() - returns -EINVAL, rollback unmaps new VMA The refcount ensures the rollback's arena_vm_close does not free the vml shared with the original VMA.

References 4

• git.kernel.org https://git.kernel.org/stable/c/201128fcc7b213d27ab77bc4e89488b41796480f
• git.kernel.org https://git.kernel.org/stable/c/4fddde2a732de60bb97e3307d4eb69ac5f1d2b74
• git.kernel.org https://git.kernel.org/stable/c/723b9fa930cc277c15ce6b9ec9feec828cfac9d7
• git.kernel.org https://git.kernel.org/stable/c/d18099f19e53250f8ad2801498b88cec29d9107a

Remediation