CVE-2023-53577

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf, cpumap: Make sure kthread is running before map update returns<br /> <br /> The following warning was reported when running stress-mode enabled<br /> xdp_redirect_cpu with some RT threads:<br /> <br /> ------------[ cut here ]------------<br /> WARNING: CPU: 4 PID: 65 at kernel/bpf/cpumap.c:135<br /> CPU: 4 PID: 65 Comm: kworker/4:1 Not tainted 6.5.0-rc2+ #1<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)<br /> Workqueue: events cpu_map_kthread_stop<br /> RIP: 0010:put_cpu_map_entry+0xda/0x220<br /> ......<br /> Call Trace:<br /> <br /> ? show_regs+0x65/0x70<br /> ? __warn+0xa5/0x240<br /> ......<br /> ? put_cpu_map_entry+0xda/0x220<br /> cpu_map_kthread_stop+0x41/0x60<br /> process_one_work+0x6b0/0xb80<br /> worker_thread+0x96/0x720<br /> kthread+0x1a5/0x1f0<br /> ret_from_fork+0x3a/0x70<br /> ret_from_fork_asm+0x1b/0x30<br /> <br /> <br /> The root cause is the same as commit 436901649731 ("bpf: cpumap: Fix memory<br /> leak in cpu_map_update_elem"). The kthread is stopped prematurely by<br /> kthread_stop() in cpu_map_kthread_stop(), and kthread() doesn&amp;#39;t call<br /> cpu_map_kthread_run() at all but XDP program has already queued some<br /> frames or skbs into ptr_ring. So when __cpu_map_ring_cleanup() checks<br /> the ptr_ring, it will find it was not emptied and report a warning.<br /> <br /> An alternative fix is to use __cpu_map_ring_cleanup() to drop these<br /> pending frames or skbs when kthread_stop() returns -EINTR, but it may<br /> confuse the user, because these frames or skbs have been handled<br /> correctly by XDP program. So instead of dropping these frames or skbs,<br /> just make sure the per-cpu kthread is running before<br /> __cpu_map_entry_alloc() returns.<br /> <br /> After apply the fix, the error handle for kthread_stop() will be<br /> unnecessary because it will always return 0, so just remove it.