CVE-2024-50138

bpf: Use raw_spinlock_t in ringbuf

published November 5, 2024

CVSS
—
EPSS
0%
Percentile
11.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

bpf: Use raw_spinlock_t in ringbuf

The function __bpf_ringbuf_reserve is invoked from a tracepoint, which

disables preemption. Using spinlock_t in this context can lead to a

"sleep in atomic" warning in the RT variant. This issue is illustrated

in the example below:

BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48

in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556208, name: test_progs

preempt_count: 1, expected: 0

RCU nest depth: 1, expected: 1

INFO: lockdep is turned off.

Preemption disabled at:

[<ffffd33a5c88ea44>] migrate_enable+0xc0/0x39c

CPU: 7 PID: 556208 Comm: test_progs Tainted: G

Hardware name: Qualcomm SA8775P Ride (DT)

Call trace:

dump_backtrace+0xac/0x130

show_stack+0x1c/0x30

dump_stack_lvl+0xac/0xe8

dump_stack+0x18/0x30

__might_resched+0x3bc/0x4fc

rt_spin_lock+0x8c/0x1a4

__bpf_ringbuf_reserve+0xc4/0x254

bpf_ringbuf_reserve_dynptr+0x5c/0xdc

bpf_prog_ac3d15160d62622a_test_read_write+0x104/0x238

trace_call_bpf+0x238/0x774

perf_call_bpf_enter.isra.0+0x104/0x194

perf_syscall_enter+0x2f8/0x510

trace_sys_enter+0x39c/0x564

syscall_trace_enter+0x220/0x3c0

do_el0_svc+0x138/0x1dc

el0_svc+0x54/0x130

el0t_64_sync_handler+0x134/0x150

el0t_64_sync+0x17c/0x180

Switch the spinlock to raw_spinlock_t to avoid this error.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00221 · 11.9th percentile
Published
2024-11-05T17:11Z
EPSS history
Timeline
  • 05 NOV 17:11Z
    bpf: Use raw_spinlock_t in ringbuf
    cvelistv5