In the Linux kernel, the following vulnerability has been resolved:
fprobe: Release rethook after the ftrace_ops is unregistered
While running bpf selftests it's possible to get following fault:
general protection fault, probably for non-canonical address \ 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUGPAGEALLOC NOPTI ... Call Trace: <TASK> fprobehandler+0xc1/0x270 ? _pfxbpftestmodinit+0x10/0x10 ? _pfxbpftestmodinit+0x10/0x10 ? bpffentrytest1+0x5/0x10 ? bpffentrytest1+0x5/0x10 ? bpftestmodinit+0x22/0x80 ? dooneinitcall+0x63/0x2e0 ? rcuiswatching+0xd/0x40 ? kmalloctrace+0xaf/0xc0 ? doinitmodule+0x60/0x250 ? _dosysfinitmodule+0xac/0x120 ? dosyscall64+0x37/0x90 ? entrySYSCALL64after_hwframe+0x72/0xdc </TASK>
In unregister_fprobe function we can't release fp->rethook while it's possible there are some of its users still running on another cpu.
Moving rethookfree call after fp->ops is unregistered with unregisterftrace_function call.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53557.json",
"cna_assigner": "Linux"
}