In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
blk-mq: pop cached request if it is usable<\/p>\n
When submitting a bio to blk-mq, if the task should sleep after peeking
\na cached request, but before it pops it, the plug flushes and calls
\nblk_mq_free_plug_rqs, freeing the cached_rqs. This creates a
\nuse-after-free bug. Fix this by popping the cached request before any
\npossible blocking calls if it is suitable for use.<\/p>\n
Popping this request first holds a queue reference, so avoid any
\nserialization races with queue freezes and can safely proceed with
\ndispatching that request to the driver. This potentially increases a
\ntiming window from when a driver wants to freeze its queue to when
\nrequests stop being dispatched. That scenario is off the fast path
\nthough, and drivers need to appropriately handle requests during a
\nfreeze request anyway.<\/p>\n
The downside is the popped element needs to be individually freed when
\nwe performed a bio plug merge. The cached request would have had to be
\nfreed later anyway, but this patch does it inline with building the plug
\nlist instead of after flushing it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
blk-mq: pop cached request if it is usable<\/p>\n
When submitting a bio to blk-mq, if the task should sleep after peeking
\na cached reques<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15013","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}