Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work complete before freeing the buffer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
457f44363a8894135c85b7a9afd2bd8196db24ab to < 47626748a2a00068dbbd5836d19076637b4e235baffected457f44363a8894135c85b7a9afd2bd8196db24ab to < de2ce6b14bc3e565708a39bdba3ef9162aeffc72affected457f44363a8894135c85b7a9afd2bd8196db24ab to < e1828c7a8d8135e21ff6adaaa9458c32aae13b11affected457f44363a8894135c85b7a9afd2bd8196db24ab to < 6451141103547f4efd774e912418a3b4318046c6affected457f44363a8894135c85b7a9afd2bd8196db24ab to < 10ca3b2eec384628bc9f5d8190aed9427ad2dde6affected457f44363a8894135c85b7a9afd2bd8196db24ab to < 430e15544f11f8de26b2b5109c7152f71b78295eaffected457f44363a8894135c85b7a9afd2bd8196db24ab to < 4e9077638301816a7d73fa1e1b4c1db4a7e3b59caffected
Linux Linux
Default version status: affected
5.8affected0 to < 5.8unaffected5.10.247 to ≤ 5.10.*unaffected5.15.197 to ≤ 5.15.*unaffected6.1.159 to ≤ 6.1.*unaffected6.6.117 to ≤ 6.6.*unaffected6.12.58 to ≤ 6.12.*unaffected6.17.8 to ≤ 6.17.*unaffected6.18 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/47626748a2a00068dbbd5836d19076637b4e235b ↗
- https://git.kernel.org/stable/c/de2ce6b14bc3e565708a39bdba3ef9162aeffc72 ↗
- https://git.kernel.org/stable/c/e1828c7a8d8135e21ff6adaaa9458c32aae13b11 ↗
- https://git.kernel.org/stable/c/6451141103547f4efd774e912418a3b4318046c6 ↗
- https://git.kernel.org/stable/c/10ca3b2eec384628bc9f5d8190aed9427ad2dde6 ↗
- https://git.kernel.org/stable/c/430e15544f11f8de26b2b5109c7152f71b78295e ↗
- https://git.kernel.org/stable/c/4e9077638301816a7d73fa1e1b4c1db4a7e3b59c ↗