In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Hold map BTF for the memory allocator destructor record<\/p>\n
bpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc
\ndestructor can release the special fields of hash and rhash map elements
\nonce the allocator frees them for good. btf_record_dup() only acquires
\nreferences on kernel and module BTF. Fields whose types live in the map
\nBTF keep pointing into it: a kptr to a local type refers to map->btf,
\nand a list_head or rb_root field carries a value_rec owned by the struct
\nmeta table of map->btf.<\/p>\n
That borrowed state can outlive the map. When RCU callbacks are still in
\nflight, bpf_mem_alloc_destroy() copies the allocator and defers the final
\ndrain, together with the destructor context, to a workqueue.
\nbpf_map_free() then frees map->record and drops the map’s BTF reference
\nas soon as map_free() returns. Once the program that loaded the BTF is
\ngone as well, the BTF is freed while the worker still uses the
\nduplicate. The worker dereferences it through btf_is_kernel() and
\nbtf_find_struct_meta() in bpf_obj_free_fields() when destroying elements
\nthat were freed under RCU, and through btf_is_kernel() in
\nbtf_record_free() when releasing the context itself:<\/p>\n
BUG: KASAN: slab-use-after-free in btf_is_kernel+0x19\/0x30
\n Read of size 1 at addr ffff88811505dce8 by task kworker\/u16:2\/50
\n Workqueue: events_unbound free_mem_alloc_deferred
\n Call Trace:
\n btf_is_kernel+0x19\/0x30
\n btf_record_free+0xc7\/0xf0
\n htab_dtor_ctx_free+0x1a\/0x30
\n free_mem_alloc_no_barrier+0x39\/0x230
\n free_mem_alloc_deferred+0x2a\/0x40
\n process_scheduled_works+0x5ce\/0x9d0
\n worker_thread+0x42a\/0x5e0
\n kthread+0x1f5\/0x230
\n ret_from_fork+0x1dd\/0x390
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
Allocated by task 358:
\n __kmalloc_cache_noprof+0x287\/0x510
\n btf_new_fd+0xf7\/0x3d0
\n __sys_bpf+0x487\/0x840<\/p>\n
Freed by task 0:
\n kfree+0x186\/0x560
\n rcu_core+0x6f6\/0xd40<\/p>\n
Freeing a map that still holds more elements than the allocator’s high
\nwatermark is enough to get there, because the bulk free during teardown
\nqueues the RCU callback that makes bpf_mem_alloc_destroy() defer.
\nNon-preallocated hash maps and resizable hash maps both register the
\ndestructor and are affected alike.<\/p>\n
Keep one reference on the map BTF in the destructor context. Every
\nnon-kernel pointer in the duplicated record is either map->btf or memory
\nowned by it, so a single reference covers kptrs, list heads, and rb
\nroots, and mirrors what bpf_map_meta_alloc() does for the duplicated
\nrecord of an inner map. Release it only after the duplicated record has
\nbeen freed: the worker is preemptible and not in an RCU read-side
\ncritical section, so dropping the last reference first would let the
\nBTF be freed while btf_record_free() still reads its fields.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Hold map BTF for the memory allocator destructor record<\/p>\n
bpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc
\nde<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41285","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}