Song Liu

A general protection fault can occur in the Linux kernel due to a failure in the `register ftrace direct` function. This issue arises when the `ftrace find rec direct` function is called, leading to a non-canonical address access. The problem is triggered by loading a livepatch that patches a kernel function and then running a `bpftrace` command that fails, causing a general protection fault on subsequent attempts. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue is related to list corruption in the `perf cgroup switch()` function, specifically on the `cgrp cpuctx list`. This corruption occurs when removing an event from the list during iteration. The vulnerability can be exploited to cause a denial of service. The path where this happens includes `perf cgroup switch()`, `list for each entry(cgrp cpuctx list)`, `cpu ctx sched in`, `ctx sched in`, `ctx pinned sched in`, `merge sched in`, and `perf cgroup event disable`. To fix this, `list for each entry safe()` should be used to allow removing an entry during iteration.

The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options.