In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix objects stuck in free_by_rcu_ttrace<\/p>\n
do_call_rcu_ttrace() returns early when call_rcu_ttrace_in_progress is set
\nand leaves the objects in free_by_rcu_ttrace. __free_rcu() frees
\nwaiting_for_gp_ttrace only and clears the flag. Hence the objects that
\nfree_bulk() or __free_by_rcu() added while RCU tasks trace GP was in flight
\nstay in free_by_rcu_ttrace until free_bulk() or alloc_bulk() is called for
\nthe same bpf_mem_cache again, which may never happen. The number of such
\nobjects is not bounded.<\/p>\n
Turn call_rcu_ttrace_in_progress into three states:
\n0 – idle
\n1 – __free_rcu() is queued
\n2 – __free_rcu() is queued and free_by_rcu_ttrace got more objects since<\/p>\n
do_call_rcu_ttrace() sets 2. __free_rcu() does cmpxchg(1 -> 0) and starts
\nthe next GP when it fails. It cannot clear the flag first and check
\nfree_by_rcu_ttrace later, since bpf_mem_alloc_destroy() frees bpf_mem_cache
\nwithout waiting for RCU callbacks when the flag is zero.<\/p>\n
Now __free_rcu() queues itself, so the one that didn’t see ‘draining’ may
\ndo call_rcu_tasks_trace() after rcu_barrier_tasks_trace() in
\nfree_mem_alloc(). Queue it under rcu_read_lock() and do synchronize_rcu()
\nbefore the barriers. Calling rcu_barrier_tasks_trace() twice works too, but
\ncreating and destroying hash maps in a loop on many cpus slows down to one
\nfree_mem_alloc() per GP and kworkers pile up.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix objects stuck in free_by_rcu_ttrace<\/p>\n
do_call_rcu_ttrace() returns early when call_rcu_ttrace_in_progress is set
\nand leaves<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41261","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41261","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41261"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41261"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41261"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}