In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: bpf: serialize device reference release in struct_ops destroy path<\/p>\n
__hid_bpf_ops_destroy_device() and hid_bpf_unreg() can race on the
\nsame registration reference, double-putting struct hid_device and
\nfreeing it while hid_destroy_device() still uses it. Serialize the
\nremove\/NULL decision under hdev->bpf.prog_list_lock so exactly one
\npath releases each registration reference: unreg re-checks ops->hdev
\nunder the lock and returns without putting when the destroy path
\nalready cleared it; all put_device() calls happen after the lock is
\ndropped, which is safe because a concurrent unreg then observes
\nops->hdev == NULL under the lock.<\/p>\n
Background: each successful attach (hid_bpf_ops_reg) acquires one
\ndevice reference (hid_get_device()). Two paths can release it:<\/p>\n
– device destruction: hid_destroy_device() -> hid_bpf_destroy_device()
\n -> __hid_bpf_ops_destroy_device(), which walks hdev->bpf.prog_list
\n under rcu_read_lock() and drops one reference per attached program;
\n– BPF link release: bpf map delete (no BPF_F_LINK) synchronously calls
\n st_ops->unreg() -> hid_bpf_unreg(), which drops the reference for
\n its own registration.<\/p>\n
The coordination handshake (e->hdev = NULL on the destroy side vs
\n“if (!hdev) return” on the unreg side) is a TOCTOU check: the two
\npaths run under different lock domains (rcu_read_lock vs
\nprog_list_lock), so a concurrent unreg can read ops->hdev as
\nnon-NULL, block on prog_list_lock, and then proceed while the
\ndestroy traversal executes – both paths then drop the same
\nreference. The refcount reaches zero legitimately (each decrement
\nis individually valid), so no refcount_t saturation fires: the
\ndevice is simply freed while the transport is still inside
\nhid_destroy_device(), and subsequent teardown touches freed memory.<\/p>\n
The fix serializes the remove\/NULL decision under prog_list_lock on
\nboth sides and moves the destroy-side puts outside the lock. With
\nthe lock held, plain reads\/writes of ops->hdev are sufficient; no
\nREAD_ONCE\/WRITE_ONCE are added, keeping the patch minimal.<\/p>\n
Unlocked-read safety: the unlocked read of ops->hdev at the top of
\nhid_bpf_unreg() cannot touch a freed device, because the unreg path
\nitself still holds this registration’s reference (released only by
\nits own hid_put_device() after the lock is dropped), and a destroy
\ntraversal that already cleared ops->hdev makes the lock-internal
\nre-check return early without any put. At most one of the two
\npaths releases each registration reference.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: bpf: serialize device reference release in struct_ops destroy path<\/p>\n
__hid_bpf_ops_destroy_device() and hid_bpf_unreg() can rac<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24689","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24689","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24689"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24689"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24689"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}