In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Disable preemption in __bpf_get_stack<\/p>\n
get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and
\nreleases its recursion slot via put_callchain_entry() before returning,
\nso nothing keeps the entry reserved while __bpf_get_stack() consumes
\nit below.<\/p>\n
A preemptible BPF program (e.g. a non-sleepable raw tracepoint program
\non a PREEMPT kernel, which runs under migrate_disable() but not
\npreempt_disable()) can be scheduled out between obtaining the entry
\nand the copy. Another task scheduled on the same CPU then reuses the
\nsame per-CPU buffer and overwrites trace->nr with a larger value.
\ncopy_len is then computed from the inflated trace->nr and can exceed
\nthe caller’s buffer, causing an out-of-bounds write in the memcpy()
\nand in the build_id path.<\/p>\n
The rcu_read_lock() taken here alone does not prevent this. It is
\nonly taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does
\nnot disable preemption; it merely keeps perf’s callchain buffer array
\nalive (freed via call_rcu()) and does nothing to stop another task
\nfrom reusing the entry.<\/p>\n
Disable preemption around obtaining the callchain entry and copying
\nit into the caller’s buffer, so the entry cannot be reused underneath
\nus and trace->nr stays bounded by max_depth. Build ID resolution may
\nfault and is therefore deferred until after preemption is re-enabled;
\nby then the instruction pointers have already been copied into buf,
\nso it operates only on that private copy. Note, preempt_disable() also
\nsubsumes the buffer-lifetime guarantee the rcu_read_lock() provided,
\nsince a preempt-disabled section is an RCU read-side critical section
\nfor the callchain buffers’ call_rcu() reclaim.<\/p>\n
[ changed Fixes: commit ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Disable preemption in __bpf_get_stack<\/p>\n
get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and
\nreleases its rec<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21502","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21502","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21502"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21502"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21502"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}