In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/handshake: Use spin_lock_bh for hn_lock<\/p>\n
nvmet_tcp_state_change(), a socket callback that runs in BH context,
\ncan reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue()
\nand tls_handshake_cancel(). handshake_req_cancel() acquires
\nhn->hn_lock with plain spin_lock(). If a process-context thread on
\nthe same CPU holds hn->hn_lock when a softirq invokes the cancel path,
\nthe lock attempt deadlocks. This is the only caller that invokes
\ntls_handshake_cancel() from BH context; every other consumer calls it
\nfrom process context.<\/p>\n
Deferring the cancel to process context in the NVMe target is not
\nstraightforward: nvmet_tcp_schedule_release_queue() must call
\ntls_handshake_cancel() atomically with its state transition to
\nDISCONNECTING. If the cancel were deferred, the handshake completion
\ncallback could fire in the window before the cancel runs, observe the
\nunexpected state, and return without dropping its kref on the queue.
\nReworking that interlock is considerably more invasive than hardening
\nthe handshake lock. Convert all hn->hn_lock acquisitions from
\nspin_lock\/spin_unlock to spin_lock_bh\/spin_unlock_bh so the lock is
\nnever taken with softirqs enabled.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/handshake: Use spin_lock_bh for hn_lock<\/p>\n
nvmet_tcp_state_change(), a socket callback that runs in BH context,
\ncan reach handsha<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14992","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}