In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix mmap_lock leak in irq_work path<\/p>\n
stack_map_get_build_id_offset() introduced a per-CPU irq_work to defer
\nmmap_read_unlock() from NMI context, and bpf_find_vma() later reused the
\nsame mmap_unlock_work. Both callers only check whether the work is busy
\nbefore taking mmap_lock, so a nested caller can reuse the slot before the
\nfirst caller queues it. Two read locks may then be acquired while only one
\ndeferred unlock runs, leaking a read lock and blocking exit_mmap().<\/p>\n
Reserve the per-CPU slot before mmap_read_trylock(). Use the same wrapper
\nin stackmap and bpf_find_vma() so both callers release the reservation on
\ntrylock failure. Keep rejecting the slot while the irq_work remains busy.
\nRelease it after the irq_work callback unlocks the mm.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix mmap_lock leak in irq_work path<\/p>\n
stack_map_get_build_id_offset() introduced a per-CPU irq_work to defer
\nmmap_read_unlock()<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25656","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25656","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25656"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25656"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25656"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}