In the Linux kernel, the following vulnerability has been resolved:
bpf: Address KCSAN report on bpflrulist
KCSAN reported a data-race when accessing node->ref. Although node->ref does not have to be accurate, take this chance to use a more common READONCE() and WRITEONCE() pattern instead of data_race().
There is an existing bpflrunodeisref() and bpflrunodesetref(). This patch also adds bpflrunodeclearref() to do the WRITE_ONCE(node->ref, 0) also.
================================================================== BUG: KCSAN: data-race in _bpflrulistrotate / _htablrupercpumapupdateelem
write to 0xffff888137038deb of 1 bytes by task 11240 on cpu 1: _bpflrunodemove kernel/bpf/bpflrulist.c:113 [inline] _bpflrulistrotateactive kernel/bpf/bpflrulist.c:149 [inline] _bpflrulistrotate+0x1bf/0x750 kernel/bpf/bpflrulist.c:240 bpflrulistpopfreetolocal kernel/bpf/bpflrulist.c:329 [inline] bpfcommonlrupopfree kernel/bpf/bpflrulist.c:447 [inline] bpflrupopfree+0x638/0xe20 kernel/bpf/bpflrulist.c:499 prealloclrupop kernel/bpf/hashtab.c:290 [inline] _htablrupercpumapupdateelem+0xe7/0x820 kernel/bpf/hashtab.c:1316 bpfpercpuhashupdate+0x5e/0x90 kernel/bpf/hashtab.c:2313 bpfmapupdatevalue+0x2a9/0x370 kernel/bpf/syscall.c:200 genericmapupdatebatch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687 bpfmapdobatch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534 _sysbpf+0x338/0x810 _dosysbpf kernel/bpf/syscall.c:5096 [inline] _sesysbpf kernel/bpf/syscall.c:5094 [inline] _x64sysbpf+0x43/0x50 kernel/bpf/syscall.c:5094 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x41/0xc0 arch/x86/entry/common.c:80 entrySYSCALL64after_hwframe+0x63/0xcd
read to 0xffff888137038deb of 1 bytes by task 11241 on cpu 0: bpflrunodesetref kernel/bpf/bpflrulist.h:70 [inline] _htablrupercpumapupdateelem+0x2f1/0x820 kernel/bpf/hashtab.c:1332 bpfpercpuhashupdate+0x5e/0x90 kernel/bpf/hashtab.c:2313 bpfmapupdatevalue+0x2a9/0x370 kernel/bpf/syscall.c:200 genericmapupdatebatch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687 bpfmapdobatch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534 _sysbpf+0x338/0x810 _dosysbpf kernel/bpf/syscall.c:5096 [inline] _sesysbpf kernel/bpf/syscall.c:5094 [inline] _x64sysbpf+0x43/0x50 kernel/bpf/syscall.c:5094 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x41/0xc0 arch/x86/entry/common.c:80 entrySYSCALL64after_hwframe+0x63/0xcd
value changed: 0x01 -> 0x00
Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 11241 Comm: syz-executor.3 Not tainted 6.3.0-rc7-syzkaller-00136-g6a66fdd29ea1 #0
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54283.json"
}