CVE-2023-53577

------------[ cut here ]------------ WARNING: CPU: 4 PID: 65 at kernel/bpf/cpumap.c:135 CPU: 4 PID: 65 Comm: kworker/4:1 Not tainted 6.5.0-rc2+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: events cpumapkthreadstop RIP: 0010:putcpumapentry+0xda/0x220 ...... Call Trace: <TASK> ? showregs+0x65/0x70 ? _warn+0xa5/0x240 ...... ? putcpumapentry+0xda/0x220 cpumapkthreadstop+0x41/0x60 processonework+0x6b0/0xb80 workerthread+0x96/0x720 kthread+0x1a5/0x1f0 retfromfork+0x3a/0x70 retfromforkasm+0x1b/0x30 </TASK>

The root cause is the same as commit 436901649731 ("bpf: cpumap: Fix memory leak in cpumapupdateelem"). The kthread is stopped prematurely by kthreadstop() in cpumapkthreadstop(), and kthread() doesn't call cpumapkthreadrun() at all but XDP program has already queued some frames or skbs into ptrring. So when _cpumapringcleanup() checks the ptrring, it will find it was not emptied and report a warning.

An alternative fix is to use _cpumapringcleanup() to drop these pending frames or skbs when kthreadstop() returns -EINTR, but it may confuse the user, because these frames or skbs have been handled correctly by XDP program. So instead of dropping these frames or skbs, just make sure the per-cpu kthread is running before _cpumapentry_alloc() returns.

After apply the fix, the error handle for kthread_stop() will be unnecessary because it will always return 0, so just remove it.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53577.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6710e1126934d8b4372b4d2f9ae1646cd3f151bf

Fixed

b44d28b98f185d2f2348aa3c3636838c316f889e

Fixed

7a1178a3671b40746830d355836b72e47ceb2490

Fixed

ecb45b852af5e88257020b88bea5ff0798d72aca

Fixed

640a604585aa30f93e39b17d4d6ba69fcb1e66c9

Affected versions

v4.*

v4.14

v4.14-rc5

v4.14-rc6

v4.14-rc7

v4.14-rc8

v4.15

v4.15-rc1

v4.15-rc2

v4.15-rc3

v4.15-rc4

v4.15-rc5

v4.15-rc6

v4.15-rc7

v4.15-rc8

v4.15-rc9

v4.16

v4.16-rc1

v4.16-rc2

v4.16-rc3

v4.16-rc4

v4.16-rc5

v4.16-rc6

v4.16-rc7

v4.17

v4.17-rc1

v4.17-rc2

v4.17-rc3

v4.17-rc4

v4.17-rc5

v4.17-rc6

v4.17-rc7

v4.18

v4.18-rc1

v4.18-rc2

v4.18-rc3

v4.18-rc4

v4.18-rc5

v4.18-rc6

v4.18-rc7

v4.18-rc8

v4.19

v4.19-rc1

v4.19-rc2

v4.19-rc3

v4.19-rc4

v4.19-rc5

v4.19-rc6

v4.19-rc7

v4.19-rc8

v4.20

v4.20-rc1

v4.20-rc2

v4.20-rc3

v4.20-rc4

v4.20-rc5

v4.20-rc6

v4.20-rc7

v5.*

v5.0

v5.0-rc1

v5.0-rc2

v5.0-rc3

v5.0-rc4

v5.0-rc5

v5.0-rc6

v5.0-rc7

v5.0-rc8

v5.1

v5.1-rc1

v5.1-rc2

v5.1-rc3

v5.1-rc4

v5.1-rc5

v5.1-rc6

v5.1-rc7

v5.10

v5.10-rc1

v5.10-rc2

v5.10-rc3

v5.10-rc4

v5.10-rc5

v5.10-rc6

v5.10-rc7

v5.11

v5.11-rc1

v5.11-rc2

v5.11-rc3

v5.11-rc4

v5.11-rc5

v5.11-rc6

v5.11-rc7

v5.12

v5.12-rc1

v5.12-rc1-dontuse

v5.12-rc2

v5.12-rc3

v5.12-rc4

v5.12-rc5

v5.12-rc6

v5.12-rc7

v5.12-rc8

v5.13

v5.13-rc1

v5.13-rc2

v5.13-rc3

v5.13-rc4

v5.13-rc5

v5.13-rc6

v5.13-rc7

v5.14

v5.14-rc1

v5.14-rc2

v5.14-rc3

v5.14-rc4

v5.14-rc5

v5.14-rc6

v5.14-rc7

v5.15

v5.15-rc1

v5.15-rc2

v5.15-rc3

v5.15-rc4

v5.15-rc5

v5.15-rc6

v5.15-rc7

v5.15.1

v5.15.10

v5.15.100

v5.15.101

v5.15.102

v5.15.103

v5.15.104

v5.15.105

v5.15.106

v5.15.107

v5.15.108

v5.15.109

v5.15.11

v5.15.110

v5.15.111

v5.15.112

v5.15.113

v5.15.114

v5.15.115

v5.15.116

v5.15.117

v5.15.118

v5.15.119

v5.15.12

v5.15.120

v5.15.121

v5.15.122

v5.15.123

v5.15.124

v5.15.125

v5.15.13

v5.15.14

v5.15.15

v5.15.16

v5.15.17

v5.15.18

v5.15.19

v5.15.2

v5.15.20

v5.15.21

v5.15.22

v5.15.23

v5.15.24

v5.15.25

v5.15.26

v5.15.27

v5.15.28

v5.15.29

v5.15.3

v5.15.30

v5.15.31

v5.15.32

v5.15.33

v5.15.34

v5.15.35

v5.15.36

v5.15.37

v5.15.38

v5.15.39

v5.15.4

v5.15.40

v5.15.41

v5.15.42

v5.15.43

v5.15.44

v5.15.45

v5.15.46

v5.15.47

v5.15.48

v5.15.49

v5.15.5

v5.15.50

v5.15.51

v5.15.52

v5.15.53

v5.15.54

v5.15.55

v5.15.56

v5.15.57

v5.15.58

v5.15.59

v5.15.6

v5.15.60

v5.15.61

v5.15.62

v5.15.63

v5.15.64

v5.15.65

v5.15.66

v5.15.67

v5.15.68

v5.15.69

v5.15.7

v5.15.70

v5.15.71

v5.15.72

v5.15.73

v5.15.74

v5.15.75

v5.15.76

v5.15.77

v5.15.78

v5.15.79

v5.15.8

v5.15.80

v5.15.81

v5.15.82

v5.15.83

v5.15.84

v5.15.85

v5.15.86

v5.15.87

v5.15.88

v5.15.89

v5.15.9

v5.15.90

v5.15.91

v5.15.92

v5.15.93

v5.15.94

v5.15.95

v5.15.96

v5.15.97

v5.15.98

v5.15.99

v5.16

v5.16-rc1

v5.16-rc2

v5.16-rc3

v5.16-rc4

v5.16-rc5

v5.16-rc6

v5.16-rc7

v5.16-rc8

v5.17

v5.17-rc1

v5.17-rc2

v5.17-rc3

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v5.2

v5.2-rc1

v5.2-rc2

v5.2-rc3

v5.2-rc4

v5.2-rc5

v5.2-rc6

v5.2-rc7

v5.3

v5.3-rc1

v5.3-rc2

v5.3-rc3

v5.3-rc4

v5.3-rc5

v5.3-rc6

v5.3-rc7

v5.3-rc8

v5.4

v5.4-rc1

v5.4-rc2

v5.4-rc3

v5.4-rc4

v5.4-rc5

v5.4-rc6

v5.4-rc7

v5.4-rc8

v5.5

v5.5-rc1

v5.5-rc2

v5.5-rc3

v5.5-rc4

v5.5-rc5

v5.5-rc6

v5.5-rc7

v5.6

v5.6-rc1

v5.6-rc2

v5.6-rc3

v5.6-rc4

v5.6-rc5

v5.6-rc6

v5.6-rc7

v5.7

v5.7-rc1

v5.7-rc2

v5.7-rc3

v5.7-rc4

v5.7-rc5

v5.7-rc6

v5.7-rc7

v5.8

v5.8-rc1

v5.8-rc2

v5.8-rc3

v5.8-rc4

v5.8-rc5

v5.8-rc6

v5.8-rc7

v5.9

v5.9-rc1

v5.9-rc2

v5.9-rc3

v5.9-rc4

v5.9-rc5

v5.9-rc6

v5.9-rc7

v5.9-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.1.1

v6.1.10

v6.1.11

v6.1.12

v6.1.13

v6.1.14

v6.1.15

v6.1.16

v6.1.17

v6.1.18

v6.1.19

v6.1.2

v6.1.20

v6.1.21

v6.1.22

v6.1.23

v6.1.24

v6.1.25

v6.1.26

v6.1.27

v6.1.28

v6.1.29

v6.1.3

v6.1.30

v6.1.31

v6.1.32

v6.1.33

v6.1.34

v6.1.35

v6.1.36

v6.1.37

v6.1.38

v6.1.39

v6.1.4

v6.1.40

v6.1.41

v6.1.42

v6.1.43

v6.1.44

v6.1.5

v6.1.6

v6.1.7

v6.1.8

v6.1.9

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.4.1

v6.4.2

v6.4.3

v6.4.4

v6.4.5

v6.4.6

v6.4.7

v6.4.8

v6.4.9

v6.5-rc1

v6.5-rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53577.json"

vanir_signatures

[
    {
        "id": "CVE-2023-53577-011e5c27",
        "target": {
            "function": "cpu_map_kthread_run",
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b44d28b98f185d2f2348aa3c3636838c316f889e",
        "digest": {
            "function_hash": "59328108497823361401599838441249974719",
            "length": 1572.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53577-26fd5439",
        "target": {
            "function": "__cpu_map_entry_alloc",
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a1178a3671b40746830d355836b72e47ceb2490",
        "digest": {
            "function_hash": "245861764595931031864701377584476915121",
            "length": 1424.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53577-3820d928",
        "target": {
            "function": "__cpu_map_entry_alloc",
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@640a604585aa30f93e39b17d4d6ba69fcb1e66c9",
        "digest": {
            "function_hash": "245861764595931031864701377584476915121",
            "length": 1424.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53577-5ad6c54b",
        "target": {
            "function": "cpu_map_kthread_stop",
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b44d28b98f185d2f2348aa3c3636838c316f889e",
        "digest": {
            "function_hash": "144335344264484137632153086552784220162",
            "length": 211.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53577-6402453a",
        "target": {
            "function": "cpu_map_kthread_stop",
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecb45b852af5e88257020b88bea5ff0798d72aca",
        "digest": {
            "function_hash": "144335344264484137632153086552784220162",
            "length": 211.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53577-76f47430",
        "target": {
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@640a604585aa30f93e39b17d4d6ba69fcb1e66c9",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "143438376298442273920926464802654990414",
                "250771888575949518523275674243928571782",
                "303757949268044798089672956859187323036",
                "265743565993017108498042715382169596201",
                "10180334402934129591783230633104027711",
                "157015782765516536576679792778283995201",
                "59501919835773192338161811586144766201",
                "113709665641243981283763825978951238647",
                "325972872204104486376820041827965104256",
                "67081723231749901790387236844454909958",
                "6304905941425533914673567932832807845",
                "110162913310688347596362697753078138444",
                "183741779348057090285139692868771297631",
                "302306194468357866488824726889657628627",
                "201147909139658975426762557161426227030",
                "24944682068804800165373135039932874705",
                "55909221691383211074674447975641021516",
                "65755660034969066084273626766704169226",
                "257076868399015462300796849971009078594",
                "49326886230236955399633341462155949151",
                "229861443575873711011138732098803860895",
                "42872310553560809291948004536962916238",
                "313516021413463993687771576377936403326",
                "38605075665589829548241315755496364302",
                "163876881819410860100233051565001162413",
                "128047395418713422891953530647034002953",
                "44585040642333322479646870248382220264",
                "219256666154436913529750288694148741527",
                "176299639361397656866298840852311923670",
                "17821537593699931483827345263907344583"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53577-8db1beba",
        "target": {
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a1178a3671b40746830d355836b72e47ceb2490",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "31418575802945226983292607567543349729",
                "226169139402218453455532113807964533807",
                "269583873111867603089090266157061141055",
                "107259744828248273615128507994301091469",
                "10180334402934129591783230633104027711",
                "157015782765516536576679792778283995201",
                "59501919835773192338161811586144766201",
                "113709665641243981283763825978951238647",
                "325972872204104486376820041827965104256",
                "67081723231749901790387236844454909958",
                "6304905941425533914673567932832807845",
                "110162913310688347596362697753078138444",
                "183741779348057090285139692868771297631",
                "302306194468357866488824726889657628627",
                "201147909139658975426762557161426227030",
                "24944682068804800165373135039932874705",
                "55909221691383211074674447975641021516",
                "65755660034969066084273626766704169226",
                "257076868399015462300796849971009078594",
                "49326886230236955399633341462155949151",
                "229861443575873711011138732098803860895",
                "42872310553560809291948004536962916238",
                "313516021413463993687771576377936403326",
                "38605075665589829548241315755496364302",
                "163876881819410860100233051565001162413",
                "128047395418713422891953530647034002953",
                "44585040642333322479646870248382220264",
                "219256666154436913529750288694148741527",
                "176299639361397656866298840852311923670",
                "17821537593699931483827345263907344583"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53577-988963b9",
        "target": {
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b44d28b98f185d2f2348aa3c3636838c316f889e",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "31418575802945226983292607567543349729",
                "226169139402218453455532113807964533807",
                "175735885896960302668492591831838947826",
                "83517906903142381303911037822382678751",
                "10180334402934129591783230633104027711",
                "157015782765516536576679792778283995201",
                "59501919835773192338161811586144766201",
                "113709665641243981283763825978951238647",
                "325972872204104486376820041827965104256",
                "67081723231749901790387236844454909958",
                "6304905941425533914673567932832807845",
                "110162913310688347596362697753078138444",
                "183741779348057090285139692868771297631",
                "302306194468357866488824726889657628627",
                "201147909139658975426762557161426227030",
                "24944682068804800165373135039932874705",
                "55909221691383211074674447975641021516",
                "65755660034969066084273626766704169226",
                "257076868399015462300796849971009078594",
                "49326886230236955399633341462155949151",
                "229861443575873711011138732098803860895",
                "42872310553560809291948004536962916238",
                "313516021413463993687771576377936403326",
                "38605075665589829548241315755496364302",
                "94841480697798446392178440980333610273",
                "134006582155979900373010443398748329357",
                "44585040642333322479646870248382220264",
                "219256666154436913529750288694148741527",
                "176299639361397656866298840852311923670",
                "17821537593699931483827345263907344583"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53577-b06b6ac3",
        "target": {
            "function": "cpu_map_kthread_stop",
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@640a604585aa30f93e39b17d4d6ba69fcb1e66c9",
        "digest": {
            "function_hash": "144335344264484137632153086552784220162",
            "length": 211.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53577-b5d1c1c3",
        "target": {
            "function": "cpu_map_kthread_run",
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a1178a3671b40746830d355836b72e47ceb2490",
        "digest": {
            "function_hash": "59328108497823361401599838441249974719",
            "length": 1572.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53577-c33ead4f",
        "target": {
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecb45b852af5e88257020b88bea5ff0798d72aca",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "143438376298442273920926464802654990414",
                "250771888575949518523275674243928571782",
                "303757949268044798089672956859187323036",
                "265743565993017108498042715382169596201",
                "10180334402934129591783230633104027711",
                "157015782765516536576679792778283995201",
                "59501919835773192338161811586144766201",
                "113709665641243981283763825978951238647",
                "325972872204104486376820041827965104256",
                "67081723231749901790387236844454909958",
                "6304905941425533914673567932832807845",
                "110162913310688347596362697753078138444",
                "183741779348057090285139692868771297631",
                "302306194468357866488824726889657628627",
                "201147909139658975426762557161426227030",
                "24944682068804800165373135039932874705",
                "55909221691383211074674447975641021516",
                "65755660034969066084273626766704169226",
                "257076868399015462300796849971009078594",
                "49326886230236955399633341462155949151",
                "229861443575873711011138732098803860895",
                "42872310553560809291948004536962916238",
                "313516021413463993687771576377936403326",
                "38605075665589829548241315755496364302",
                "163876881819410860100233051565001162413",
                "128047395418713422891953530647034002953",
                "44585040642333322479646870248382220264",
                "219256666154436913529750288694148741527",
                "176299639361397656866298840852311923670",
                "17821537593699931483827345263907344583"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53577-c3a31a1e",
        "target": {
            "function": "__cpu_map_entry_alloc",
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b44d28b98f185d2f2348aa3c3636838c316f889e",
        "digest": {
            "function_hash": "61414893430206803631026512124113699505",
            "length": 1416.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53577-c8316e26",
        "target": {
            "function": "cpu_map_kthread_stop",
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a1178a3671b40746830d355836b72e47ceb2490",
        "digest": {
            "function_hash": "144335344264484137632153086552784220162",
            "length": 211.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53577-cc5c4bab",
        "target": {
            "function": "__cpu_map_entry_alloc",
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecb45b852af5e88257020b88bea5ff0798d72aca",
        "digest": {
            "function_hash": "245861764595931031864701377584476915121",
            "length": 1424.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53577-d08bd968",
        "target": {
            "function": "cpu_map_kthread_run",
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecb45b852af5e88257020b88bea5ff0798d72aca",
        "digest": {
            "function_hash": "15642097272404235098973166296759969808",
            "length": 1567.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53577-d454de27",
        "target": {
            "function": "cpu_map_kthread_run",
            "file": "kernel/bpf/cpumap.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@640a604585aa30f93e39b17d4d6ba69fcb1e66c9",
        "digest": {
            "function_hash": "15642097272404235098973166296759969808",
            "length": 1567.0
        },
        "signature_type": "Function"
    }
]

Git / github.com/gregkh/linux