In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()<\/p>\n
syzbot reported a suspicious RCU usage warning in ip6_pkt_drop():<\/p>\n
WARNING: suspicious RCU usage in ip6_pkt_drop
\n include\/net\/addrconf.h:389 suspicious rcu_dereference_check() usage!<\/p>\n
Call Trace:
\n __in6_dev_get_safely include\/net\/addrconf.h:389 [inline]
\n ip6_pkt_drop+0x596\/0x610 net\/ipv6\/route.c:4620
\n ip6_pkt_discard+0x1c\/0x30 net\/ipv6\/route.c:4651
\n xfrm_trans_reinject+0x324\/0x630 net\/xfrm\/xfrm_input.c:806
\n process_one_work kernel\/workqueue.c:3322 [inline]
\n process_scheduled_works+0xa8e\/0x14e0 kernel\/workqueue.c:3405
\n worker_thread+0xa47\/0xfb0 kernel\/workqueue.c:3486<\/p>\n
When commit 4f4920669d21 (“xfrm: Reinject transport-mode packets through
\nworkqueue”) converted xfrm_trans_reinject from a tasklet to a workqueue,
\nthe reinjection loop ceased running in softirq context. Workqueue workers
\nrun in process context where local_bh_disable() does not enter an RCU
\nread-side critical section under CONFIG_PREEMPT_RCU.<\/p>\n
Because finish callbacks (such as ip6_rcv_finish) expect to run under an
\nRCU read lock (performing route lookups, l3mdev lookups, and accessing
\nRCU-protected data structures), invoking them in workqueue context without
\nrcu_read_lock() triggers RCU lockdep warnings.<\/p>\n
Furthermore, packets queued to the workqueue via xfrm_trans_queue_net()
\nmay carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref).
\nAdditionally, on netdevice unregistration, dst_dev_put() replaces dst->dev
\nwith blackhole_netdev, so dst entries do not keep skb->dev alive while
\nqueued in the workqueue.<\/p>\n
Fix these issues by:
\n1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the
\n caller’s RCU section to ensure dst is reference-counted before queuing.
\n2. Holding a reference on skb->dev via dev_hold()\/dev_put() across workqueue
\n deferral so skb->dev remains valid during finish() callback processing.
\n3. Acquiring rcu_read_lock() around the finish callback invocation loop in
\n xfrm_trans_reinject().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()<\/p>\n
syzbot reported a suspicious RCU usage<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33438","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}