In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Cancel special fields on map value recycle<\/p>\n
Map update and delete paths currently call bpf_obj_free_fields() when a
\nvalue is being replaced or recycled. That makes field destruction depend
\non the context of the update\/delete operation. For tracing programs this
\ncan include NMI context, where referenced kptr destructors, uptr
\nunpinning, and graph root destruction are not generally safe.<\/p>\n
Introduce bpf_obj_cancel_fields() for the reusable-value path. It only
\nperforms NMI-safe cleanup for timer, workqueue, and task_work fields.
\nFields that need full destruction are left attached to the recycled value
\nand are destroyed by the final cleanup path instead.<\/p>\n
Switch array and hashtab update\/delete\/recycle paths to this cancel
\nhelper. Keep bpf_obj_free_fields() for final map destruction and for
\nbpf_mem_alloc destructors. Preallocated hashtabs do not have allocator
\ndestructors, so teardown continues to walk the normal and extra elements
\nand fully destroy their fields.<\/p>\n
This deliberately relaxes the eager-free semantics of map update\/delete
\nfor special fields. Programs that relied on a recycled map slot becoming
\nempty immediately after update\/delete were relying on behavior that
\ncannot be implemented safely from every BPF execution context without
\noffloading arbitrary destructors.<\/p>\n
There is a chance this change breaks programs making assumptions
\nregarding the eager freeing of fields. If so, we can relax semantics to
\ncancellation only when irqs_disabled() is true in the future. However,
\ntheoretically, map values that get reused eagerly already have weaker
\nguarantees as parallel users can recreate freed fields before the new
\nelement becomes visible again.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Cancel special fields on map value recycle<\/p>\n
Map update and delete paths currently call bpf_obj_free_fields() when a
\nvalue is b<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7260","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7260","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7260"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7260"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7260"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}