CVE-2024-56694

In the Linux kernel, the following vulnerability has been resolved:

bpf: fix recursive lock when verdict program return SK_PASS

When the stream_verdict program returns SK_PASS, it places the received skb

into its own receive queue, but a recursive lock eventually occurs, leading

to an operating system deadlock. This issue has been present since v6.9.

'''

sk_psock_strp_data_ready

write_lock_bh(&sk->sk_callback_lock)

strp_data_ready

strp_read_sock

read_sock -> tcp_read_sock

strp_recv

cb.rcv_msg -> sk_psock_strp_read

# now stream_verdict return SK_PASS without peer sock assign

__SK_PASS = sk_psock_map_verd(SK_PASS, NULL)

sk_psock_verdict_apply

sk_psock_skb_ingress_self

sk_psock_skb_ingress_enqueue

sk_psock_data_ready

read_lock_bh(&sk->sk_callback_lock) <= dead lock

'''

This topic has been discussed before, but it has not been fixed.

Previous discussion:

https://lore.kernel.org/all/[email protected]