In the Linux kernel, the following vulnerability has been resolved:
tcp: tcpmakesynack() can be called from process context
tcprtxsynack() now could be called in process context as explained in 0a375c822497 ("tcp: tcprtxsynack() can be called from process context").
tcprtxsynack() might call tcpmakesynack(), which will touch per-CPU variables with preemption enabled. This causes the following BUG:
BUG: using __this_cpu_add() in preemptible [00000000] code: ThriftIO1/5464
caller is tcp_make_synack+0x841/0xac0
Call Trace:
<TASK>
dump_stack_lvl+0x10d/0x1a0
check_preemption_disabled+0x104/0x110
tcp_make_synack+0x841/0xac0
tcp_v6_send_synack+0x5c/0x450
tcp_rtx_synack+0xeb/0x1f0
inet_rtx_syn_ack+0x34/0x60
tcp_check_req+0x3af/0x9e0
tcp_rcv_state_process+0x59b/0x2030
tcp_v6_do_rcv+0x5f5/0x700
release_sock+0x3a/0xf0
tcp_sendmsg+0x33/0x40
____sys_sendmsg+0x2f2/0x490
__sys_sendmsg+0x184/0x230
do_syscall_64+0x3d/0x90
Avoid calling _TCPINCSTATS() with will touch per-cpu variables. Use TCPINC_STATS() which is safe to be called from context switch.
{ "vanir_signatures": [ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bced3f7db95ff2e6ca29dc4d1c9751ab5e736a09", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "192610079959406394726514623944520960920", "39744024570895197234532490790414555036", "312158523604593821933354579360006786377", "328656466067269787155309705255961242173" ] }, "id": "CVE-2023-53121-34c8d5fd", "target": { "file": "net/ipv4/tcp_output.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77ad58bca0119e8cc3e0e9d91a3f22caa66e4dfa", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "185350671356968061877890889100697513188", "84939974578674318806949680808219940456", "312158523604593821933354579360006786377", "328656466067269787155309705255961242173" ] }, "id": "CVE-2023-53121-3c6468f7", "target": { "file": "net/ipv4/tcp_output.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad07290d63ff6689f50565b02f5b6f34ec15a5ca", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "185350671356968061877890889100697513188", "84939974578674318806949680808219940456", "312158523604593821933354579360006786377", "328656466067269787155309705255961242173" ] }, "id": "CVE-2023-53121-43617f4b", "target": { "file": "net/ipv4/tcp_output.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9180aa4622a720b433e842b4d3aa34d73eec577a", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "192610079959406394726514623944520960920", "39744024570895197234532490790414555036", "312158523604593821933354579360006786377", "328656466067269787155309705255961242173" ] }, "id": "CVE-2023-53121-79edf2cd", "target": { "file": "net/ipv4/tcp_output.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@442aa78ed70188b21ccd8669738448702c0a3281", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "185350671356968061877890889100697513188", "84939974578674318806949680808219940456", "312158523604593821933354579360006786377", "328656466067269787155309705255961242173" ] }, "id": "CVE-2023-53121-892338f1", "target": { "file": "net/ipv4/tcp_output.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d493d4fe88195a144d6a277a90062a7534ed2192", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "185350671356968061877890889100697513188", "84939974578674318806949680808219940456", "312158523604593821933354579360006786377", "328656466067269787155309705255961242173" ] }, "id": "CVE-2023-53121-9d6f4354", "target": { "file": "net/ipv4/tcp_output.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e23ca307745be3df7fe9762f3e2a7e311a57852e", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "185350671356968061877890889100697513188", "84939974578674318806949680808219940456", "312158523604593821933354579360006786377", "328656466067269787155309705255961242173" ] }, "id": "CVE-2023-53121-b15cad04", "target": { "file": "net/ipv4/tcp_output.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7613cde8c0c1f02a7ec2e1d536c01b65b135fc1c", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "192610079959406394726514623944520960920", "39744024570895197234532490790414555036", "312158523604593821933354579360006786377", "328656466067269787155309705255961242173" ] }, "id": "CVE-2023-53121-b8d2d192", "target": { "file": "net/ipv4/tcp_output.c" }, "deprecated": false, "signature_version": "v1" } ] }