Linux kernel bpf: reused slab objects leave htab special fields stale, causing hard lockup

Impact

Elements freed into the BPF memory allocator can be reused immediately; for non-preallocated hash maps the reuse reinitializes special fields such as bpf_spin_lock while a concurrent lookup is still reading them. The reported outcome is a hard lockup inside queued_spin_lock_slowpath reached from the bpf map lookup syscall path. On a node running an eBPF dataplane or eBPF observability agents, a wedged CPU means the host stops scheduling work and every tenant pod on it dies with no graceful drain.

Who can reach it

Local user able to create and operate non-preallocated BPF hash maps with special fields - CAP_BPF or root in the initial namespace, or a privileged agent container. Unprivileged BPF is disabled by default on most distributions, which narrows this considerably.

What to do

Update to a stable kernel carrying the __GFP_ZERO fix in the BPF allocator (commits 5d447e04290e, 678ea18d6240, 997849c4b969) and reboot the node. Until then, keep unprivileged BPF disabled (kernel.unprivileged_bpf_disabled=1) and limit which workloads hold CAP_BPF.

References

Related entries

• Linux kernel (drivers/iommu/iommufd): The destroy ioctl takes a temporary reference on an iommufd object without theCVE-2023-53795 · Linux kernel (drivers/iommu/iommufd)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A use-after-free in the amdkfd (KFD compute driverCVE-2023-53816 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel bpf/sockmap: SKB refcount race gives use-after-free in the backlog workerCVE-2023-53836 · Linux kernel BPF sockmap (sk_psock_backlog SKB refcount)High
• Linux kernel sched/psi: use-after-free when a cgroup is removed under a poll() on its pressure fileCVE-2023-54019 · Linux kernel sched/psi (cgroup pressure-stall trigger polling)High
• Linux kernel crypto/essiv: EBUSY from a backlogged request frees live data, giving a use-after-freeCVE-2023-54046 · Linux kernel crypto essiv template (MAY_BACKLOG EBUSY handling)High
• Linux kernel bpf: preemption left enabled in bpf_event_output corrupts shared perf sample bufferCVE-2023-54173 · Linux kernel BPF (bpf_event_output preemption)High