CVE-2024-53160

Nel kernel Linux, è stata risolta la seguente vulnerabilità:

rcu/kvfree: Correzione della race condition sui dati in __mod_timer / kvfree_call_rcu

KCSAN segnala una race condition nell'accesso alla variabile krcp->monitor_work.timer.expires
nella funzione schedule_delayed_monitor_work():

<snip>
BUG: KCSAN: race condition in __mod_timer / kvfree_call_rcu

lettura di 8 byte a 0xffff888237d1cce8 da parte del task 10149 sulla CPU 1:
schedule_delayed_monitor_work kernel/rcu/tree.c:3520 [inline]
kvfree_call_rcu+0x3b8/0x510 kernel/rcu/tree.c:3839
trie_update_elem+0x47c/0x620 kernel/bpf/lpm_trie.c:441
bpf_map_update_value+0x324/0x350 kernel/bpf/syscall.c:203
generic_map_update_batch+0x401/0x520 kernel/bpf/syscall.c:1849
bpf_map_do_batch+0x28c/0x3f0 kernel/bpf/syscall.c:5143
__sys_bpf+0x2e5/0x7a0
__do_sys_bpf kernel/bpf/syscall.c:5741 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5739 [inline]
__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5739
x64_sys_call+0x2625/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:322
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

scrittura di 8 byte a 0xffff888237d1cce8 da parte del task 56 sulla CPU 0:
__mod_timer+0x578/0x7f0 kernel/time/timer.c:1173
add_timer_global+0x51/0x70 kernel/time/timer.c:1330
__queue_delayed_work+0x127/0x1a0 kernel/workqueue.c:2523
queue_delayed_work_on+0xdf/0x190 kernel/workqueue.c:2552
queue_delayed_work include/linux/workqueue.h:677 [inline]
schedule_delayed_monitor_work kernel/rcu/tree.c:3525 [inline]
kfree_rcu_monitor+0x5e8/0x660 kernel/rcu/tree.c:3643
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3310
worker_thread+0x51d/0x6f0 kernel/workqueue.c:3391
kthread+0x1d1/0x210 kernel/kthread.c:389
ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Segnalato da Kernel Concurrency Sanitizer su:
CPU: 0 UID: 0 PID: 56 Comm: kworker/u8:4 Non contaminato 6.12.0-rc2-syzkaller-00050-g5b7c893ed5ed #0
Nome hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 13/09/2024
Workqueue: events_unbound kfree_rcu_monitor
<snip>

La funzione kfree_rcu_monitor() riattiva il work se un "krcp" deve ancora essere gestito
e questa operazione viene eseguita senza acquisire il lock di krcp, mentre
kvfree_call_rcu() lo detiene.

Correggere acquisendo il lock "krcp->lock" in kfree_rcu_monitor() in modo che
entrambe le funzioni non concorrano più.