In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
io-wq: check that the predecessor is hashed in io_wq_remove_pending()<\/p>\n
io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled
\nwork was the tail of its hash bucket. When doing this, it checks whether
\nthe preceding entry in acct->work_list has the same hash value, but
\nnever checks that the predecessor is hashed at all. io_get_work_hash()
\nis simply atomic_read(&work->flags) >> IO_WQ_HASH_SHIFT, and the hash
\nbits are never set for non-hashed work, so it returns 0. Thus, when a
\nhashed bucket-0 work is cancelled while a non-hashed work is its list
\npredecessor, the check spuriously passes and a pointer to the non-hashed
\nio_kiocb is stored in wq->hash_tail[0].<\/p>\n
Because non-hashed work is dequeued via the fast path in
\nio_get_next_work(), which never touches hash_tail[], the stale pointer
\nis never cleared. Therefore, after the non-hashed io_kiocb completes and
\nis freed back to req_cachep, wq->hash_tail[0] is a dangling pointer. The
\nio_wq is per-task (tctx->io_wq) and survives ring open\/close, so the
\ndangling pointer persists for the lifetime of the task; the next hashed
\nbucket-0 enqueue dereferences it in io_wq_insert_work() and
\nwq_list_add_after() writes through freed memory.<\/p>\n
Add the missing io_wq_is_hashed() check so a non-hashed predecessor
\nnever inherits a hash_tail[] slot.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
io-wq: check that the predecessor is hashed in io_wq_remove_pending()<\/p>\n
io_wq_remove_pending() needs to fix up wq->hash_tail[] if th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15962","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15962","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15962"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15962"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15962"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}