In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ftrace: fork: Initialize function graph state before copy_exec_state()<\/p>\n
dup_task_struct() copies the parent’s task_struct, including ret_stack.
\nftrace_graph_init_task() clears the copied function graph state, but it
\ncurrently runs after copy_exec_state().<\/p>\n
For non-CLONE_VM forks, copy_exec_state() allocates a new task_exec_state.
\nIf that allocation fails, copy_process() reaches bad_fork_free and
\nfree_task() calls ftrace_graph_exit_task(). Since the child still carries
\nthe parent’s ret_stack pointer, the unwind frees the parent’s active
\nfunction graph return stack. The parent subsequently accesses freed memory
\nfrom function_graph_enter_regs().<\/p>\n
KASAN reports:<\/p>\n
[ 22.190920] ==================================================================
\n[ 22.195899] BUG: KASAN: slab-use-after-free in function_graph_enter_regs+0xa76\/0xb90
\n[ 22.200747] Write of size 8 at addr ff110000054dc0a8 by task repro\/1
\n[ 22.205134]
\n[ 22.210770] CPU: 0 UID: 0 PID: 1 Comm: repro Not tainted 7.2.0-07732-g9328b3b03bdc-dirty #3 PREEMPT(lazy)
\n[ 22.212576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04\/01\/2014
\n[ 22.213750] Call Trace:
\n[ 22.215271]
\n[ 22.216242] ? ftrace_stub_direct_tramp+0x10\/0x10
\n[ 22.217774] dump_stack_lvl+0x4e\/0x70
\n[ 22.220531] print_report+0x157\/0x4b4
\n[ 22.223202] ? fixup_red_left+0x9\/0x30
\n[ 22.224407] ? complete_report_info+0x83\/0x110
\n[ 22.226679] ? function_graph_enter_regs+0xa76\/0xb90
\n[ 22.228084] kasan_report+0xce\/0x100
\n[ 22.230109] ? function_graph_enter_regs+0xa76\/0xb90
\n[ 22.232860] ? stack_trace_save+0x4\/0xd0
\n[ 22.234156] function_graph_enter_regs+0xa76\/0xb90
\n[ 22.236090] ? kasan_save_stack+0x30\/0x50
\n[ 22.237752] ? __pfx_function_graph_enter_regs+0x10\/0x10
\n[ 22.238694] ? ring_buffer_lock_reserve+0x345\/0xf80
\n[ 22.239628] ? stack_trace_save+0x4\/0xd0
\n[ 22.242121] ? stack_trace_save+0x4\/0xd0
\n[ 22.243588] ftrace_graph_func+0xda\/0x160
\n[ 22.245362] ? ftrace_stub_direct_tramp+0x10\/0x10
\n[ 22.246520] 0xffffffffa0000095
\n[ 22.250528] ? stack_trace_save+0x9\/0xd0
\n[ 22.251757] ? ring_buffer_unlock_commit+0x11d\/0x5c0
\n[ 22.253152] stack_trace_save+0x9\/0xd0
\n[ 22.254264] kasan_save_stack+0x30\/0x50
\n[ 22.273631] kasan_save_track+0x14\/0x30
\n[ 22.276763] kasan_save_free_info+0x3b\/0x70
\n[ 22.278296] __kasan_slab_free+0x43\/0x70
\n[ 22.280157] kmem_cache_free+0xbf\/0x3b0
\n[ 22.282963] ? ftrace_stub_direct_tramp+0x10\/0x10
\n[ 22.284001] free_task+0xa2\/0x160
\n[ 22.285699] ? ftrace_stub_direct_tramp+0x10\/0x10
\n[ 22.286752] copy_process+0x2aae\/0x7bc0<\/p>\n
Initialize the child function graph state immediately after
\ndup_task_struct(), before the first fallible operation.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ftrace: fork: Initialize function graph state before copy_exec_state()<\/p>\n
dup_task_struct() copies the parent’s task_struct, includin<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29093","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29093","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29093"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29093"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29093"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}