In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Reject legacy packet loads from callbacks<\/p>\n
check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a
\nsubprogram as an implicit return with R0 set to zero. It calls
\nprepare_func_exit() to explore this synthesized path.<\/p>\n
When the load is reached directly from a synchronous callback,
\nprepare_func_exit() enforces the callback return contract and marks R0
\nprecise. R0 is not derived from a real instruction on this path, so
\nprecision backtracking reaches the callback call with R0 still requested
\nand triggers the “callback unexpected regs” verifier bug. A privileged
\nprogram loader can therefore cause a verifier warning and an -EFAULT
\nBPF_PROG_LOAD.<\/p>\n
These legacy packet-load instructions are deprecated. Reject them from
\ncallbacks rather than complicating their implicit-return model. Check all
\nactive frames before constructing the implicit return so nested static
\nsubprograms cannot hide the callback context.<\/p>\n
Global functions are verified independently with a fresh frame zero, so
\nan active-frame check cannot identify a global function called from a
\ncallback. Also check the complete subprogram call graph during stack-depth
\nvalidation and reject a function containing a legacy load when any caller
\nis a callback. This covers global and static descendants without making
\nhas_ld_abs transitive, preserving its per-function BTF return-type check.
\nOrdinary uses outside callbacks remain supported.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Reject legacy packet loads from callbacks<\/p>\n
check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a
\nsubprogram as an impli<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29199","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29199","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29199"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29199"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29199"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}