In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock when freeing cgroup storage The following commit bc235cdb423a ("bpf: Prevent deadlock from recursive bpftaskstorage[get|delete]") first introduced deadlock prevention for fentry/fexit programs attaching on bpftaskstorage helpers. That commit also employed the logic in map free path in its v6 version. Later bpfcgrpstorage was first introduced in c4bcfb38a95e ("bpf: Implement cgroup storage available to non-cgroup-attached bpf progs") which faces the same issue as bpftaskstorage, instead of its busy counter, NULL was passed to bpflocalstoragemapfree() which opened a window to cause deadlock: <TASK> (acquiring localstorage->lock) rawspinlockirqsave+0x3d/0x50 bpflocalstorageupdate+0xd1/0x460 bpfcgrpstorageget+0x109/0x130 bpfproga4d4a370ba857314cgrpptr+0x139/0x170 ? _bpfprogenterrecur+0x16/0x80 bpftrampoline6442485186+0x43/0xa4 cgroupstorageptr+0x9/0x20 (holding localstorage->lock) bpfselemunlinkstoragenolock.constprop.0+0x135/0x160 bpfselemunlinkstorage+0x6f/0x110 bpflocalstoragemapfree+0xa2/0x110 bpfmapfreedeferred+0x5b/0x90 processonework+0x17c/0x390 workerthread+0x251/0x360 kthread+0xd2/0x100 retfromfork+0x34/0x50 retfromforkasm+0x1a/0x30 </TASK> Progs: - A: SEC("fentry/cgroupstorageptr") - cgid (BPFMAPTYPEHASH) Record the id of the cgroup the current task belonging to in this hash map, using the address of the cgroup as the map key. - cgrpa (BPFMAPTYPECGRPSTORAGE) If current task is a kworker, lookup the above hash map using function parameter @owner as the key to get its corresponding cgroup id which is then used to get a trusted pointer to the cgroup through bpfcgroupfromid(). This trusted pointer can then be passed to bpfcgrpstorageget() to finally trigger the deadlock issue. - B: SEC("tpbtf/sysenter") - cgrpb (BPFMAPTYPECGRPSTORAGE) The only purpose of this prog is to fill Prog A's hash map by calling bpfcgrpstorage_get() for as many userspace tasks as possible. Steps to reproduce: - Run A; - while (true) { Run B; Destroy B; } Fix this issue by passing its busy counter to the free procedure so it can be properly incremented before storage/smap locking.
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-azure-6.11-cloud-tools-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-azure-6.11-headers-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-azure-6.11-tools-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-cloud-tools-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-azure-dbgsym", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-gcp-6.11-headers-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-gcp-6.11-lib-rust-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-gcp-6.11-tools-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-64k-dbgsym", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-dbgsym", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-cloud-tools-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-headers-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-headers-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-hwe-6.11-cloud-tools-6.11.0-26", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-hwe-6.11-headers-6.11.0-26", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-hwe-6.11-lib-rust-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-hwe-6.11-tools-6.11.0-26", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-6.11.0-26-generic-dbgsym", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-26-generic-64k-dbgsym", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-26-generic-dbgsym", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-ipu6-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-ipu7-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-usbio-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-vision-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-tools-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-tools-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-cloud-tools-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-64k-dbgsym", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-dbgsym", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-lowlatency-hwe-6.11-cloud-tools-6.11.0-1014", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-lowlatency-hwe-6.11-headers-6.11.0-1014", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-lowlatency-hwe-6.11-lib-rust-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-lowlatency-hwe-6.11-tools-6.11.0-1014", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1010-nvidia", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-buildinfo-6.11.0-1010-nvidia-64k", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-headers-6.11.0-1010-nvidia", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-headers-6.11.0-1010-nvidia-64k", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-image-unsigned-6.11.0-1010-nvidia", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-image-unsigned-6.11.0-1010-nvidia-64k", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-image-unsigned-6.11.0-1010-nvidia-64k-dbgsym", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-image-unsigned-6.11.0-1010-nvidia-dbgsym", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-modules-6.11.0-1010-nvidia", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-modules-6.11.0-1010-nvidia-64k", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-modules-extra-6.11.0-1010-nvidia", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-modules-extra-6.11.0-1010-nvidia-64k", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-modules-nvidia-fs-6.11.0-1010-nvidia", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-modules-nvidia-fs-6.11.0-1010-nvidia-64k", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-nvidia-6.11-headers-6.11.0-1010", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-nvidia-6.11-lib-rust-6.11.0-1010-nvidia", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-nvidia-6.11-tools-6.11.0-1010", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-tools-6.11.0-1010-nvidia", "binary_version": "6.11.0-1010.10" }, { "binary_name": "linux-tools-6.11.0-1010-nvidia-64k", "binary_version": "6.11.0-1010.10" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-headers-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-image-unsigned-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-image-unsigned-6.11.0-1022-oem-dbgsym", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-ipu6-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-ipu7-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-usbio-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-vision-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-oem-6.11-headers-6.11.0-1022", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-oem-6.11-tools-6.11.0-1022", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-tools-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" } ] }