In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
locking\/lockdep: Invalidate stale class_cache entries for zapped classes<\/p>\n
syzbot reported a lockdep splat hitting DEBUG_LOCKS_WARN_ON(1) in
\nhlock_class() due to an invalid class_idx:<\/p>\n
WARNING: kernel\/locking\/lockdep.c:238 at __lock_acquire+0x382\/0x2cf0 kernel\/locking\/lockdep.c:5203
\n Workqueue: wg-crypt-wg0 wg_packet_tx_worker
\n RIP: 0010:hlock_class kernel\/locking\/lockdep.c:238 [inline]
\n RIP: 0010:check_wait_context kernel\/locking\/lockdep.c:4870 [inline]
\n RIP: 0010:__lock_acquire+0x389\/0x2cf0 kernel\/locking\/lockdep.c:5203
\n Call Trace:<\/p>\n
lock_acquire+0x106\/0x350 kernel\/locking\/lockdep.c:5886
\n _raw_spin_lock+0x2e\/0x40 kernel\/locking\/spinlock.c:173
\n tcp_tsq_handler+0x29\/0x200 net\/ipv4\/tcp_output.c:1291
\n tcp_tsq_workfn+0x384\/0x410 net\/ipv4\/tcp_output.c:1325
\n …<\/p>\n
When a lock class is zapped (e.g. during module unload or key
\nunregistration), zap_class() clears the class’s bit in
\nlock_classes_in_use and removes it from the class hash table.
\nHowever, existing lockdep_map instances embedded in data structures
\nmay still retain a pointer to the zapped class in their class_cache[]
\narray.<\/p>\n
When __lock_acquire() subsequently runs on such a lock, it finds
\nlock->class_cache[subclass] != NULL, skipping register_lock_class()
\nand assigning hlock->class_idx to the index of the zapped class. When
\ncheck_wait_context() or hlock_class() inspects the held_lock, it finds
\n!test_bit(class_idx, lock_classes_in_use) and warns. Furthermore, if
\nthe zapped slot is subsequently re-allocated to an unrelated lock key,
\nthe stale class_cache entry would erroneously match the unrelated
\nclass (ABA issue).<\/p>\n
Add lock_class_cache_is_valid() to validate that the cached class is
\nwithin lock_classes bounds, still allocated in lock_classes_in_use
\n(using uninstrumented arch_test_bit() in __always_inline context so it
\nis safe in noinstr contexts like match_held_lock()), and that
\nclass->key matches the expected subkey (taking lockdep_set_subclass()
\noverrides into account). Also use READ_ONCE()\/WRITE_ONCE() when
\naccessing class_cache[]. If the entry is invalid or stale, fall back
\nto register_lock_class() \/ look_up_lock_class().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
locking\/lockdep: Invalidate stale class_cache entries for zapped classes<\/p>\n
syzbot reported a lockdep splat hitting DEBUG_LOCKS_WARN_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-39069","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/39069","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=39069"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=39069"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=39069"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}