In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
zram: fix use-after-free in zram_writeback_endio<\/p>\n
A crash was observed in zram_writeback_endio due to a NULL pointer
\ndereference in wake_up. The root cause is a race condition between the
\nbio completion handler (zram_writeback_endio) and the writeback task.<\/p>\n
In zram_writeback_endio, wake_up() is called on &wb_ctl->done_wait after
\nreleasing wb_ctl->done_lock. This creates a race window where the
\nwriteback task can see num_inflight become 0, return, and free wb_ctl
\nbefore zram_writeback_endio calls wake_up().<\/p>\n
CPU 0 (zram_writeback_endio) CPU 1 (writeback_store)
\n============================ ============================
\n zram_writeback_slots
\n zram_submit_wb_request
\n zram_submit_wb_request
\n wait_event(wb_ctl->done_wait)
\nspin_lock(&wb_ctl->done_lock);
\nlist_add(&req->entry, &wb_ctl->done_reqs);
\nspin_unlock(&wb_ctl->done_lock);
\nwake_up(&wb_ctl->done_wait);
\n zram_complete_done_reqs
\nspin_lock(&wb_ctl->done_lock);
\nlist_add(&req->entry, &wb_ctl->done_reqs);
\nspin_unlock(&wb_ctl->done_lock);
\n while (num_inflight) > 0)
\n spin_lock(&wb_ctl->done_lock);
\n list_del(&req->entry);
\n spin_unlock(&wb_ctl->done_lock);
\n \/\/ num_inflight becomes 0
\n atomic_dec(num_inflight);<\/p>\n
\/\/ Leave zram_writeback_slots
\n \/\/ Free wb_ctl
\n release_wb_ctl(wb_ctl);
\n\/\/ UAF crash!
\nwake_up(&wb_ctl->done_wait);<\/p>\n
This patch fixes this race by using RCU. By protecting wb_ctl with
\nrcu_read_lock() in zram_writeback_endio and using kfree_rcu() to free it,
\nwe ensure that wb_ctl remains valid during the execution of
\nzram_writeback_endio.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
zram: fix use-after-free in zram_writeback_endio<\/p>\n
A crash was observed in zram_writeback_endio due to a NULL pointer
\ndereference in<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14978","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14978","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14978"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14978"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14978"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}