In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix mmap_lock deadlock on arena lock failure<\/p>\n
Reported by the Sashiko AI review.<\/p>\n
arena_vm_fault() returns VM_FAULT_RETRY when it can’t take
\narena->spinlock, but it never took mmap_lock. The fault path assumes a
\nVM_FAULT_RETRY handler already dropped mmap_lock and re-takes it on the
\nretry, so mmap_lock gets taken twice and can deadlock:<\/p>\n
\tdo_user_addr_fault()
\n\t{
\n\t\tfault = handle_mm_fault(…); \/\/ calls arena_vm_fault()
\n\t\tif (fault & VM_FAULT_RETRY)
\n\t\t\tgoto retry; \/\/ re-locks mmap_lock
\n\t\tmmap_read_unlock(mm);
\n\t}<\/p>\n
Return VM_FAULT_SIGBUS instead, for two reasons:<\/p>\n
1. We could keep VM_FAULT_RETRY, but then we’d have to drop the fault
\n lock first and cap the retry ourselves, the way __folio_lock_or_retry()
\n does.<\/p>\n
2. A failed raw_res_spin_lock_irqsave() already means a possible deadlock
\n was detected, so retrying just hits the same lock again.<\/p>\n
So returning VM_FAULT_RETRY here is overkill.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix mmap_lock deadlock on arena lock failure<\/p>\n
Reported by the Sashiko AI review.<\/p>\n
arena_vm_fault() returns VM_FAULT_RETRY when<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25751","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25751","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25751"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25751"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25751"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}