Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically affecting how it manages memory for high-performance data processing (XDP). Under certain conditions, the system may attempt to perform incompatible operations simultaneously, leading to a kernel crash or system instability. This could allow a local user to cause a denial-of-service, impacting the availability of the affected server or device.
Technical details
The vulnerability is a 'BUG: Invalid wait context' within the Linux kernel's XDP (Express Data Path) subsystem. It occurs because xdp_unreg_mem_model() calls page_pool_destroy() while holding an RCU read lock (rcu_read_lock()). Internally, page_pool_destroy() eventually calls mem_allocator_disconnect(), which attempts to acquire a mutex lock. In Linux kernel locking semantics, acquiring a mutex (which can sleep) while holding an RCU read lock (an atomic context) is invalid and triggers a kernel panic or warning. The fix involves removing the unnecessary RCU read lock and using rhashtable_lookup_fast(), as the memory allocator object is already protected by reference counting in the control plane.
Affected products
- Linux Linux Kernel 5.3.18 to 5.4, 6.10.0-rc6+
Timeline
- 2024-07-12: patched: Initial patch submitted by Taehee Yoo
- 2024-08-17: disclosed: CVE-2024-43834 published
References
- https://git.kernel.org/stable/c/12144069209eec7f2090ce9afa15acdcc2c2a537
- https://git.kernel.org/stable/c/3fc1be360b99baeea15cdee3cf94252cd3a72d26
- https://git.kernel.org/stable/c/59a931c5b732ca5fc2ca727f5a72aeabaafa85ec
- https://git.kernel.org/stable/c/6c390ef198aa69795427a5cb5fd7cb4bc7e6cd7a
- https://git.kernel.org/stable/c/be9d08ff102df3ac4f66e826ea935cf3af63a4bd
- https://git.kernel.org/stable/c/bf0ce5aa5f2525ed1b921ba36de96e458e77f482
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html