In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sched_ext: Fix NULL sched deref in kfunc sub-sched error paths<\/p>\n
When the root scheduler has sub-scheds attached, the COMPAT kfunc
\nwrappers scx_bpf_select_cpu_and() and scx_bpf_dsq_insert_vtime() refuse
\nthe call and report to @p’s scheduler:<\/p>\n
\tscx_error(scx_task_sched(p), “… must be used”);<\/p>\n
The wrappers are reachable with tasks that have no scheduler.
\nscx_bpf_select_cpu_and() is in the select_cpu kfunc group, which
\nscx_kfunc_context_filter() opens to BPF_PROG_TYPE_SYSCALL programs;
\nscx_bpf_dsq_insert_vtime() is in the enqueue_dispatch group, which
\nops.enqueue() and ops.dispatch() may call with any KF_RCU task — the
\ngroup has no kf_tasks validation, and scx_dsq_insert_preamble() checks
\ntask ownership with scx_task_on_sched() precisely because @p may be an
\narbitrary task.<\/p>\n
scx_task_sched(p) is p->scx.sched, which is NULL for tasks past
\nsched_ext_dead() — which clears it via scx_disable_and_exit_task() on
\nexit — and for idle tasks, which the enable paths skip as they are
\nnever scheduled through SCX. It is also an rcu_dereference_protected()
\nthat expects @p’s pi_lock or rq lock, which neither wrapper holds.
\nPassing NULL to scx_error() reaches scx_vexit(), which dereferences
\nsch->exit_info, oopsing the kernel.<\/p>\n
One concrete trigger exercised while developing the fix: a
\nBPF_PROG_TYPE_SYSCALL program calling the select_cpu_and wrapper on an
\nexited-but-not-reaped task while a sub-scheduler was attached (its pid
\nstays findable while the zombie is unreaped; faulting instruction is
\nthe scx_vexit() prologue “mov r15,[rdi+0x398]” with RDI=NULL and 0x398
\nthe offset of sch->exit_info):<\/p>\n
sched_ext: BPF scheduler “kfunc_subsched_null” enabled
\n sched_ext: BPF sub-scheduler “kfunc_subsched_null” enabled
\n sched_ext: Unassociated program run_select_cpu_ (id 76)
\n BUG: kernel NULL pointer dereference, address: 0000000000000398
\n #PF: supervisor read access in kernel mode
\n #PF: error_code(0x0000) – not-present page
\n Oops: Oops: 0000 [#1] SMP NOPTI
\n CPU: 7 UID: 0 PID: 8201 Comm: kfunc_test_runn Tainted: G W
\n RIP: 0010:scx_vexit+0x25\/0xa0
\n Code: … 8b bf 98 03 00 00 …
\n CR2: 0000000000000398
\n Call Trace:<\/p>\n
__scx_exit+0x4f\/0x70
\n scx_bpf_select_cpu_and+0xab\/0xb0
\n bpf_prog_430ed61a7b66e03a_run_select_cpu_and+0x9c\/0xe7
\n ? __x64_sys_bpf+0x2c\/0x40
\n bpf_prog_test_run_syscall+0x130\/0x2f0
\n __sys_bpf+0x930\/0x10d0
\n ? __x64_sys_bpf+0x2c\/0x40
\n __x64_sys_bpf+0x2c\/0x40
\n do_syscall_64+0xbc\/0x460
\n entry_SYSCALL_64_after_hwframe+0x76\/0x7e<\/p>\n
Read @p’s scheduler under RCU instead, which the wrappers can do from
\ntheir guard(rcu)(): fault it when it can be determined, and when it
\ncan’t be determined — @p is a task past sched_ext_dead() or an idle
\ntask — there is nothing obviously wrong to report, so just refuse the
\ncall as before without faulting any scheduler.<\/p>\n
These COMPAT wrappers are scheduled for eventual removal once the
\ndeprecation grace period elapses, but until then — and regardless of
\ntheir removal timeline — they must not oops the kernel on a task they
\nare handed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sched_ext: Fix NULL sched deref in kfunc sub-sched error paths<\/p>\n
When the root scheduler has sub-scheds attached, the COMPAT kfunc
\nw<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33289","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33289"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}