{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Call free_htab_elem() after htab_unlock_bucket()\n\nFor htab of maps, when the map is removed from the htab, it may hold the\nlast reference of the map. bpf_map_fd_put_ptr() will invoke\nbpf_map_free_id() to free the id of the removed map element. However,\nbpf_map_fd_put_ptr() is invoked while holding a bucket lock\n(raw_spin_lock_t), and bpf_map_free_id() attempts to acquire map_idr_lock\n(spinlock_t), triggering the following lockdep warning:\n\n  =============================\n  [ BUG: Invalid wait context ]\n  6.11.0-rc4+ #49 Not tainted\n  -----------------------------\n  test_maps/4881 is trying to lock:\n  ffffffff84884578 (map_idr_lock){+...}-{3:3}, at: bpf_map_free_id.part.0+0x21/0x70\n  other info that might help us debug this:\n  context-{5:5}\n  2 locks held by test_maps/4881:\n   #0: ffffffff846caf60 (rcu_read_lock){....}-{1:3}, at: bpf_fd_htab_map_update_elem+0xf9/0x270\n   #1: ffff888149ced148 (\u0026htab-\u003elockdep_key#2){....}-{2:2}, at: htab_map_update_elem+0x178/0xa80\n  stack backtrace:\n  CPU: 0 UID: 0 PID: 4881 Comm: test_maps Not tainted 6.11.0-rc4+ #49\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ...\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x6e/0xb0\n   dump_stack+0x10/0x20\n   __lock_acquire+0x73e/0x36c0\n   lock_acquire+0x182/0x450\n   _raw_spin_lock_irqsave+0x43/0x70\n   bpf_map_free_id.part.0+0x21/0x70\n   bpf_map_put+0xcf/0x110\n   bpf_map_fd_put_ptr+0x9a/0xb0\n   free_htab_elem+0x69/0xe0\n   htab_map_update_elem+0x50f/0xa80\n   bpf_fd_htab_map_update_elem+0x131/0x270\n   htab_map_update_elem+0x50f/0xa80\n   bpf_fd_htab_map_update_elem+0x131/0x270\n   bpf_map_update_value+0x266/0x380\n   __sys_bpf+0x21bb/0x36b0\n   __x64_sys_bpf+0x45/0x60\n   x64_sys_call+0x1b2a/0x20d0\n   do_syscall_64+0x5d/0x100\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nOne way to fix the lockdep warning is using raw_spinlock_t for\nmap_idr_lock as well. However, bpf_map_alloc_id() invokes\nidr_alloc_cyclic() after acquiring map_idr_lock, it will trigger a\nsimilar lockdep warning because the slab\u0027s lock (s-\u003ecpu_slab-\u003elock) is\nstill a spinlock.\n\nInstead of changing map_idr_lock\u0027s type, fix the issue by invoking\nhtab_put_fd_value() after htab_unlock_bucket(). However, only deferring\nthe invocation of htab_put_fd_value() is not enough, because the old map\npointers in htab of maps can not be saved during batched deletion.\nTherefore, also defer the invocation of free_htab_elem(), so these\nto-be-freed elements could be linked together similar to lru map.\n\nThere are four callers for -\u003emap_fd_put_ptr:\n\n(1) alloc_htab_elem() (through htab_put_fd_value())\nIt invokes -\u003emap_fd_put_ptr() under a raw_spinlock_t. The invocation of\nhtab_put_fd_value() can not simply move after htab_unlock_bucket(),\nbecause the old element has already been stashed in htab-\u003eextra_elems.\nIt may be reused immediately after htab_unlock_bucket() and the\ninvocation of htab_put_fd_value() after htab_unlock_bucket() may release\nthe newly-added element incorrectly. Therefore, saving the map pointer\nof the old element for htab of maps before unlocking the bucket and\nreleasing the map_ptr after unlock. Beside the map pointer in the old\nelement, should do the same thing for the special fields in the old\nelement as well.\n\n(2) free_htab_elem() (through htab_put_fd_value())\nIts caller includes __htab_map_lookup_and_delete_elem(),\nhtab_map_delete_elem() and __htab_map_lookup_and_delete_batch().\n\nFor htab_map_delete_elem(), simply invoke free_htab_elem() after\nhtab_unlock_bucket(). For __htab_map_lookup_and_delete_batch(), just\nlike lru map, linking the to-be-freed element into node_to_free list\nand invoking free_htab_elem() for these element after unlock. It is safe\nto reuse batch_flink as the link for node_to_free, because these\nelements have been removed from the hash llist.\n\nBecause htab of maps doesn\u0027t support lookup_and_delete operation,\n__htab_map_lookup_and_delete_elem() doesn\u0027t have the problem, so kept\nit as\n---truncated---"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Llamar a free_htab_elem() despu\u00e9s de htab_unlock_bucket() Para htab de mapas, cuando el mapa se elimina del htab, puede contener la \u00faltima referencia del mapa. bpf_map_fd_put_ptr() invocar\u00e1 bpf_map_free_id() para liberar el id del elemento del mapa eliminado. Sin embargo, bpf_map_fd_put_ptr() se invoca mientras se mantiene un bloqueo de dep\u00f3sito (raw_spin_lock_t), y bpf_map_free_id() intenta adquirir map_idr_lock (spinlock_t), lo que activa la siguiente advertencia de lockdep: ============================== [ ERROR: Contexto de espera no v\u00e1lido ] 6.11.0-rc4+ #49 No contaminado ----------------------------- test_maps/4881 est\u00e1 intentando bloquear: ffffffff84884578 (map_idr_lock){+...}-{3:3}, en: bpf_map_free_id.part.0+0x21/0x70 otra informaci\u00f3n que podr\u00eda ayudarnos a depurar esto: context-{5:5} 2 bloqueos mantenidos por test_maps/4881: #0: ffffffff846caf60 (rcu_read_lock){....}-{1:3}, en: bpf_fd_htab_map_update_elem+0xf9/0x270 #1: ffff888149ced148 (\u0026amp;htab-\u0026gt;lockdep_key#2){....}-{2:2}, en: htab_map_update_elem+0x178/0xa80 seguimiento de pila: CPU: 0 UID: 0 PID: 4881 Comm: test_maps No contaminado 6.11.0-rc4+ #49 Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), ... Seguimiento de llamadas:  dump_stack_lvl+0x6e/0xb0 dump_stack+0x10/0x20 __lock_acquire+0x73e/0x36c0 lock_acquire+0x182/0x450 _raw_spin_lock_irqsave+0x43/0x70 bpf_map_free_id.part.0+0x21/0x70 bpf_map_put+0xcf/0x110 bpf_map_fd_put_ptr+0x9a/0xb0 free_htab_elem+0x69/0xe0 htab_map_update_elem+0x50f/0xa80 bpf_fd_htab_map_update_elem+0x131/0x270 htab_map_update_elem+0x50f/0xa80 bpf_fd_htab_map_update_elem+0x131/0x270 bpf_map_update_value+0x266/0x380 __sys_bpf+0x21bb/0x36b0 __x64_sys_bpf+0x45/0x60 x64_sys_call+0x1b2a/0x20d0 do_syscall_64+0x5d/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e Una forma de corregir la advertencia de lockdep es usar raw_spinlock_t tambi\u00e9n para map_idr_lock. Sin embargo, bpf_map_alloc_id() invoca idr_alloc_cyclic() despu\u00e9s de adquirir map_idr_lock, activar\u00e1 una advertencia de lockdep similar porque el bloqueo del slab (s-\u0026gt;cpu_slab-\u0026gt;lock) sigue siendo un spinlock. En lugar de cambiar el tipo de map_idr_lock, solucione el problema invocando htab_put_fd_value() despu\u00e9s de htab_unlock_bucket(). Sin embargo, solo aplazar la invocaci\u00f3n de htab_put_fd_value() no es suficiente, porque los punteros de mapa antiguos en htab de mapas no se pueden guardar durante la eliminaci\u00f3n por lotes. Por lo tanto, tambi\u00e9n aplace la invocaci\u00f3n de free_htab_elem(), para que estos elementos a liberar se puedan vincular entre s\u00ed de forma similar a lru map. Hay cuatro invocadores para -\u0026gt;map_fd_put_ptr: (1) alloc_htab_elem() (a trav\u00e9s de htab_put_fd_value()) Invoca -\u0026gt;map_fd_put_ptr() bajo un raw_spinlock_t. La invocaci\u00f3n de htab_put_fd_value() no se puede mover simplemente despu\u00e9s de htab_unlock_bucket(), porque el elemento antiguo ya se ha almacenado en htab-\u0026gt;extra_elems. Se puede reutilizar inmediatamente despu\u00e9s de htab_unlock_bucket() y la invocaci\u00f3n de htab_put_fd_value() despu\u00e9s de htab_unlock_bucket() puede liberar el elemento reci\u00e9n agregado de manera incorrecta. Por lo tanto, se guarda el puntero del mapa del elemento antiguo para htab de mapas antes de desbloquear el dep\u00f3sito y se libera map_ptr despu\u00e9s del desbloqueo. Adem\u00e1s del puntero del mapa en el elemento antiguo, se debe hacer lo mismo para los campos especiales en el elemento antiguo tambi\u00e9n. (2) free_htab_elem() (a trav\u00e9s de htab_put_fd_value()) Su llamador incluye __htab_map_lookup_and_delete_elem(), htab_map_delete_elem() y __htab_map_lookup_and_delete_batch(). Para htab_map_delete_elem(), simplemente invoque free_htab_elem() despu\u00e9s de htab_unlock_bucket(). Para __htab_map_lookup_and_delete_batch(), al igual que lru map, vinculando el elemento a liberar en la lista node_to_free e invocando free_htab_elem() para estos elementos despu\u00e9s del desbloqueo. Es seguro reutilizar batch_flink como el enlace para node_to_free, ---truncado---"
    }
  ],
  "id": "CVE-2024-56592",
  "lastModified": "2024-12-27T15:15:18.500",
  "metrics": {},
  "published": "2024-12-27T15:15:18.500",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/10e8a2dec9ff1b81de8e892b0850924038adbc6d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a50b4aa3007e63a590d501341f304676ebc74b3b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b9e9ed90b10c82a4e9d4d70a2890f06bfcdd3b78"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}