In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs<\/p>\n
commit 4f375ade6aa9 (“bpf: Avoid RCU context warning when unpinning
\nhtab with internal structs”) moved inode cleanup from ->free_inode()
\ninto ->destroy_inode() to avoid sleeping in RCU context when calling
\nbpf_any_put(). However this removed the RCU delay on freeing the
\ninode itself and the cached symlink body (i_link), both of which
\ncan be accessed by RCU pathwalk (pick_link, may_lookup etc.).<\/p>\n
This causes a use-after-free when a concurrent unlinkat() drops the
\nlast inode reference and destroy_inode() frees the inode immediately,
\nwhile another task is still walking the path in RCU mode and reads
\ninode->i_opflags (offset +2) inside current_time() -> is_mgtime().<\/p>\n
KASAN reports:
\n BUG: KASAN: slab-use-after-free in is_mgtime include\/linux\/fs.h:2313
\n Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags)<\/p>\n
The rules (per Al Viro):
\n ->destroy_inode() called immediately, can sleep, use for blocking
\n cleanup e.g. bpf_any_put()
\n ->free_inode() called after RCU grace period, use for freeing
\n inode and anything RCU-accessible e.g. i_link<\/p>\n
Fix: split the two concerns properly:
\n – keep bpf_any_put() in bpf_destroy_inode() since it is blocking
\n and needs to run promptly
\n – introduce bpf_free_inode() to handle kfree(i_link) and
\n free_inode_nonrcu() with proper RCU delay, preventing the UAF<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs<\/p>\n
commit 4f375ade6aa9 (“bpf: Avoid RCU context warning when unpinning
\nh<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7314","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7314","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7314"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7314"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7314"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}