In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context<\/p>\n
bpf_sock_destroy() runs from the tcp iterator, under rcu_read_lock(). If
\nthe sock is a listener that still has children in its accept queue,
\ntcp_abort() ends up in inet_csk_listen_stop() and the cond_resched()
\nthere trips the debug check:<\/p>\n
BUG: sleeping function called from invalid context at net\/ipv4\/inet_connection_sock.c:1523
\nin_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 628, name: test_progs
\npreempt_count: 0, expected: 0
\nRCU nest depth: 1, expected: 0
\nlocks held by test_progs\/628: 3, last CPU#3:
\n #0: ffff8881158cee18 (&p->lock){+.+.}-{4:4}, at: bpf_seq_read+0x56\/0x1210
\n #1: ffff8881106bb858 (sk_lock-AF_INET6){+.+.}-{0:0}, at: bpf_iter_tcp_seq_show+0x32b\/0x4b0
\n #2: ffffffffb435af20 (rcu_read_lock){….}-{1:3}, at: bpf_iter_run_prog+0x46b\/0xde0
\nCPU: 3 UID: 0 PID: 628 Comm: test_progs Tainted: G W 7.2.0+ #65 PREEMPT
\nTainted: [W]=WARN
\nCall Trace:<\/p>\n
dump_stack_lvl+0xc1\/0xf0
\n dump_stack+0x10\/0x20
\n __might_resched+0x3d2\/0x610
\n inet_csk_listen_stop+0x7b\/0xbf0
\n tcp_abort+0x23b\/0x3b0
\n bpf_sock_destroy+0xfc\/0x140
\n bpf_prog_448133d24601754f_iter_tcp6_server+0x81\/0x8a
\n bpf_iter_run_prog+0x538\/0xde0
\n bpf_iter_tcp_seq_show+0x26b\/0x4b0
\n bpf_seq_read+0x424\/0x1210
\n vfs_read+0x197\/0xe40
\n ksys_read+0x119\/0x240
\n __x64_sys_read+0x72\/0xc0
\n x64_sys_call+0x647\/0x27e0
\n do_syscall_64+0xe5\/0x610
\n entry_SYSCALL_64_after_hwframe+0x76\/0x7e
\nRIP: 0033:0x7fad39b28aca
\nRSP: 002b:00007ffc381c61c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
\nRAX: ffffffffffffffda RBX: 00007ffc381c6a88 RCX: 00007fad39b28aca
\nRDX: 0000000000000032 RSI: 00007ffc381c6250 RDI: 0000000000000014
\nRBP: 00007ffc381c61e0 R08: 0000000000000000 R09: 0000000000000000
\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
\nR13: 0000000000000000 R14: 000055f077c1bbb0 R15: 00007fad3a0f3000<\/p>\n
The commit that added the kfunc already guards lock_sock() in tcp_abort()
\nand udp_abort() with has_current_bpf_ctx(), but missed the listener path.
\nDo the same for the cond_resched(). The loop runs inside the iterator’s
\nrcu_read_lock(), it must not reschedule or report a quiescent state there.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context<\/p>\n
bpf_sock_destroy() runs from the tcp iterator, under rcu_read<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41118","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41118","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41118"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41118"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41118"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}