In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks<\/p>\n
__bpf_prog_put_rcu() is the call_rcu() callback for non-sleepable programs.
\nsecurity_bpf_prog_free() called from there fires bpf_prog_free in softirq;
\nif a sleepable LSM prog is attached to that hook, might_fault() BUGs:<\/p>\n
BUG: sleeping function called from invalid context
\n in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5038
\n preempt_count: 101, expected: 0
\n Call Trace:<\/p>\n
__bpf_prog_enter_sleepable+0x1cd\/0x320 kernel\/bpf\/trampoline.c:1255
\n bpf_trampoline_6442549705+0x53\/0xd7
\n security_bpf_prog_free+0xde\/0x130 security\/security.c:5465
\n __bpf_prog_put_rcu+0xab\/0xd0 kernel\/bpf\/syscall.c:2365
\n rcu_do_batch kernel\/rcu\/tree.c:2617 [inline]
\n handle_softirqs+0x236\/0x800 kernel\/softirq.c:622<\/p>\n
The call_rcu\/call_rcu_tasks_trace split reflects the freed program’s
\nsleepability, not that of any attached observer.<\/p>\n
security_bpf_prog_free() also frees prog->aux->security, which has to stay
\nafter the grace period, so drop bpf_prog_free from sleepable_lsm_hooks
\nrather than move the call. Non-sleepable observers still run there.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks<\/p>\n
__bpf_prog_put_rcu() is the call_rcu() callback for non-sleepable programs.
\ns<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26030","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26030","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26030"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26030"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26030"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}