Linux Kernel RCU and Mutex Deadlock Vulnerability in BPF Event Handling

A deadlock vulnerability has been identified in the Linux kernel's BPF (Berkeley Packet Filter) event handling, specifically between the RCU (Read-Copy-Update) task tracing and the event mutex. This deadlock occurs when the CPU A frees an event, which involves destroying a performance kprobe. During this process, it locks the event mutex and unregisters the performance trace event, leading to a deadlock situation. Additionally, the BPF program test run syscall can also create a similar deadlock by pinning a BPF program on a CPU, loading it, and then attempting to trace an event while holding the event mutex.

Impact

Exploitation of this vulnerability leads to a deadlock, causing the system to hang indefinitely as processes wait on each other to release locks.

Remediation

The vulnerability has been addressed by delegating the event tracing management to a workqueue, thereby avoiding the circular lock dependency. Users should ensure they are running a version of the Linux kernel that includes this fix.