Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark sched_process_wait argument as nullable do_wait() passes wo->wo_pid to the sched_process_wait tracepoint. kernel_wait4() leaves wo_pid NULL for wait4(-1), and kernel_waitid_prepare() does likewise for waitid(P_ALL). btf_ctx_access() currently types argument 0 as PTR_TO_BTF_ID | PTR_TRUSTED. Without PTR_MAYBE_NULL, the verifier accepts an unchecked dereference. Trusted pointer loads have no fault protection, so a wait for any child can then cause a NULL pointer dereference in JITed BPF code. Add sched_process_wait to raw_tp_null_args[] with argument 0 marked nullable. The verifier rejects an unchecked dereference while preserving access after the program checks the pointer for NULL.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b2fc4b17fc13810ef440fb323fad3981cd174985 to < bee862c79cb7e0e5c33b2df2e3a31d164705120daffected838a10bd2ebfe11a60dd67687533a7cfc220cc86 to < 3c03a1b8ded858685a73c1ba4080adef99db4544affected838a10bd2ebfe11a60dd67687533a7cfc220cc86 to < b9205e936dde9a94e93376c8de6195b740bcd5d2affected838a10bd2ebfe11a60dd67687533a7cfc220cc86 to < a453d6e3b8e8e1a321c8744d6189d763af9287d0affected6.12.6 to < 6.12.111affected
Linux Linux
Default version status: affected
6.13affected0 to < 6.13unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected