In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
erofs: fix managed cache race for unaligned extents<\/p>\n
After unaligned compressed extents were introduced, the following race
\ncould occur:<\/p>\n
[Thread 1] [Thread 2]
\n(z_erofs_fill_bio_vec)<\/p>\n
…
\nfilemap_add_folio (1)
\n (z_erofs_bind_cache)<\/p>\n
..
\n ..
\nfolio_attach_private (2)
\n filemap_add_folio (3) again<\/p>\n
Since (1) is executed but (2) hasn’t been executed yet, it’s possible
\nthat another thread finds the same managed folio in z_erofs_bind_cache()
\nfor a different pcluster and calls filemap_add_folio() again since
\nfolio->private is still Z_EROFS_PREALLOCATED_FOLIO.<\/p>\n
Fix this by explicitly clearing folio->private before making the folio
\nvisible in the managed cache so that another pcluster can simply wait
\non the locked managed folio as what we did for other shared cases [1].<\/p>\n
This only impacts unaligned data compression (`-E48bit` with zstd,
\nfor example).<\/p>\n
[1] Commit 9e2f9d34dd12 (“erofs: handle overlapped pclusters out of
\n crafted images properly”) was originally introduced to handle crafted
\n overlapped extents, but it addresses unaligned extents as well.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
erofs: fix managed cache race for unaligned extents<\/p>\n
After unaligned compressed extents were introduced, the following race
\ncould o<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15023","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15023","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15023"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15023"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15023"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}