In the Linux kernel, the following vulnerability has been resolved: bpf: Fix crash due to incorrect copymapvalue When both bpfspinlock and bpftimer are present in a BPF map value, copymapvalue needs to skirt both objects when copying a value into and out of the map. However, the current code does not set both soff and toff in copymapvalue, which leads to a crash when e.g. bpfspinlock is placed in map value with bpftimer, as bpfmapupdateelem call will be able to overwrite the other timer object. When the issue is not fixed, an overwriting can produce the following splat: [root@(none) bpf]# ./testprogs -t timercrash [ 15.930339] bpftestmod: loading out-of-tree module taints kernel. [ 16.037849] ================================================================== [ 16.038458] BUG: KASAN: user-memory-access in _pvqueuedspinlockslowpath+0x32b/0x520 [ 16.038944] Write of size 8 at addr 0000000000043ec0 by task testprogs/325 [ 16.039399] [ 16.039514] CPU: 0 PID: 325 Comm: testprogs Tainted: G OE 5.16.0+ #278 [ 16.039983] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.15.0-1 04/01/2014 [ 16.040485] Call Trace: [ 16.040645] <TASK> [ 16.040805] dumpstacklvl+0x59/0x73 [ 16.041069] ? _pvqueuedspinlockslowpath+0x32b/0x520 [ 16.041427] kasanreport.cold+0x116/0x11b [ 16.041673] ? _pvqueuedspinlockslowpath+0x32b/0x520 [ 16.042040] _pvqueuedspinlockslowpath+0x32b/0x520 [ 16.042328] ? memcpy+0x39/0x60 [ 16.042552] ? pvhash+0xd0/0xd0 [ 16.042785] ? lockdephardirqsoff+0x95/0xd0 [ 16.043079] _bpfspinlockirqsave+0xdf/0xf0 [ 16.043366] ? bpfgetcurrentcomm+0x50/0x50 [ 16.043608] ? jhash+0x11a/0x270 [ 16.043848] bpftimercancel+0x34/0xe0 [ 16.044119] bpfprogc4ea1c0f7449940dsysenter+0x7c/0x81 [ 16.044500] bpftrampoline64424778380+0x36/0x1000 [ 16.044836] _x64sysnanosleep+0x5/0x140 [ 16.045119] dosyscall64+0x59/0x80 [ 16.045377] ? lockisheldtype+0xe4/0x140 [ 16.045670] ? irqentryexittousermode+0xa/0x40 [ 16.046001] ? markheldlocks+0x24/0x90 [ 16.046287] ? asmexcpagefault+0x1e/0x30 [ 16.046569] ? asmexcpagefault+0x8/0x30 [ 16.046851] ? lockdephardirqson+0x7e/0x100 [ 16.047137] entrySYSCALL64afterhwframe+0x44/0xae [ 16.047405] RIP: 0033:0x7f9e4831718d [ 16.047602] Code: b4 0c 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b3 6c 0c 00 f7 d8 64 89 01 48 [ 16.048764] RSP: 002b:00007fff488086b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000023 [ 16.049275] RAX: ffffffffffffffda RBX: 00007f9e48683740 RCX: 00007f9e4831718d [ 16.049747] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff488086d0 [ 16.050225] RBP: 00007fff488086f0 R08: 00007fff488085d7 R09: 00007f9e4cb594a0 [ 16.050648] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f9e484cde30 [ 16.051124] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 16.051608] </TASK> [ 16.051762] ==================================================================
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-5.15.0-1008-intel-iotg", "binary_version": "5.15.0-1008.11~20.04.1" }, { "binary_name": "linux-cloud-tools-5.15.0-1008-intel-iotg", "binary_version": "5.15.0-1008.11~20.04.1" }, { "binary_name": "linux-headers-5.15.0-1008-intel-iotg", "binary_version": "5.15.0-1008.11~20.04.1" }, { "binary_name": "linux-image-unsigned-5.15.0-1008-intel-iotg", "binary_version": "5.15.0-1008.11~20.04.1" }, { "binary_name": "linux-image-unsigned-5.15.0-1008-intel-iotg-dbgsym", "binary_version": "5.15.0-1008.11~20.04.1" }, { "binary_name": "linux-intel-iotg-5.15-cloud-tools-5.15.0-1008", "binary_version": "5.15.0-1008.11~20.04.1" }, { "binary_name": "linux-intel-iotg-5.15-cloud-tools-common", "binary_version": "5.15.0-1008.11~20.04.1" }, { "binary_name": "linux-intel-iotg-5.15-headers-5.15.0-1008", "binary_version": "5.15.0-1008.11~20.04.1" }, { "binary_name": "linux-intel-iotg-5.15-tools-5.15.0-1008", "binary_version": "5.15.0-1008.11~20.04.1" }, { "binary_name": "linux-intel-iotg-5.15-tools-common", "binary_version": "5.15.0-1008.11~20.04.1" }, { "binary_name": "linux-intel-iotg-5.15-tools-host", "binary_version": "5.15.0-1008.11~20.04.1" }, { "binary_name": "linux-modules-5.15.0-1008-intel-iotg", "binary_version": "5.15.0-1008.11~20.04.1" }, { "binary_name": "linux-modules-extra-5.15.0-1008-intel-iotg", "binary_version": "5.15.0-1008.11~20.04.1" }, { "binary_name": "linux-tools-5.15.0-1008-intel-iotg", "binary_version": "5.15.0-1008.11~20.04.1" } ] }