In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Reject programs with inlined helpers if JIT is not available<\/p>\n
When an architecture (such as LoongArch, ARM64, and RISC-V) implements
\nbpf_jit_inlines_helper_call(), the verifier skips rewriting the helper
\ncall offset (insn->imm) in bpf_do_misc_fixups(). This is because the
\nhelper is expected to be inlined by the JIT compiler later. Therefore,
\ninsn->imm remains as the raw helper enum ID.<\/p>\n
However, if JIT is disabled at runtime (net.core.bpf_jit_enable=0) or
\nif JIT compilation fails dynamically (e.g., due to OOM), the program
\nfalls back to the BPF interpreter.<\/p>\n
When the interpreter executes (__bpf_call_base + insn->imm) with the
\nunpatched raw ID, it jumps into an invalid address space, triggering
\nan instruction alignment fault or a kernel panic.<\/p>\n
Although these helpers have valid C implementations in the kernel, the
\nomission of offset rewriting makes runtime interpreter fallback fatal.<\/p>\n
Fix this by setting ‘prog->jit_required = 1’ when helper call rewriting
\nis skipped for JIT inlining. This ensures that such programs are safely
\nrejected if JIT is not available, preventing the runtime kernel panic.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Reject programs with inlined helpers if JIT is not available<\/p>\n
When an architecture (such as LoongArch, ARM64, and RISC-V) impl<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25992","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}