In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Reject tail calls directly from callback frames<\/p>\n
A tail call from a non-zero frame is modeled as a return from that frame.
\nThe verifier makes R0 unknown and calls prepare_func_exit() for the taken
\nbranch.<\/p>\n
When the current frame is a synchronous callback, prepare_func_exit()
\nenforces the callback return-value contract and marks R0 precise. Since the
\ntail-call path synthesized R0 rather than deriving it from an instruction,
\nprecision backtracking reaches the callback-calling instruction with R0
\nstill requested and triggers the “callback unexpected regs” verifier bug.
\nA CAP_BPF task can therefore cause a WARN and an -EFAULT BPF_PROG_LOAD.<\/p>\n
Tail calls reachable from callbacks are already rejected later by
\ncheck_max_stack_depth(). Reject a tail call made directly by a callback
\nbefore constructing the inconsistent return state, using the existing
\ndiagnostic. Tail calls from ordinary subprograms keep their current
\nbehavior.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Reject tail calls directly from callback frames<\/p>\n
A tail call from a non-zero frame is modeled as a return from that frame.
\nThe<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29216","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29216","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29216"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29216"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29216"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}