In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
futex: Fix race in futex_pivot_pending() during private hash resize<\/p>\n
A task performing a custom private hash resize can remain blocked in
\nuninterruptible sleep indefinitely. The hung-task detector reports:<\/p>\n
INFO: task futex-resizer:314 blocked for more than 10 seconds.
\n task:futex-resizer state:D stack:14824 pid:314 tgid:312 ppid:311<\/p>\n
Call Trace:
\n __schedule+0x521\/0xf30
\n schedule+0x22\/0xa0
\n futex_hash_allocate+0x3db\/0x490
\n __do_sys_prctl+0x6f5\/0xbd0
\n do_syscall_64+0xf9\/0x530
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n
Kernel panic – not syncing: hung_task: blocked tasks<\/p>\n
futex_pivot_pending() allows the resize request to continue when
\neither no replacement hash is pending (hash_new == NULL) or the current
\nhash reference count has reached zero.<\/p>\n
After the final-reference wake, another futex task can complete the
\npivot between the two observations:<\/p>\n
T1 T2<\/p>\n
futex_hash_allocate()
\n wait_var_event(mm, …)
\n futex_pivot_pending(mm)
\n hash_new != NULL
\n futex_hash()
\n futex_ref_get(old) -> false
\n futex_pivot_hash(mm)
\n hash_new = NULL
\n __futex_pivot_hash(mm, new)
\n rcu_assign_pointer(hash, new)
\n fph = rcu_dereference(hash) \/* new *\/
\n futex_ref_is_dead(fph) -> false
\n schedule()<\/p>\n
The pivot changes the state from hash_new != NULL with a dead current
\nhash to hash_new == NULL with a live current hash. Because
\nfutex_pivot_pending() reads hash_new and hash without serialization,
\nthe resize task can observe hash_new in the pre-pivot state and hash in
\nthe post-pivot state, causing futex_pivot_pending() to return false even
\nthough the pivot has completed. The task then goes to sleep after the
\nwakeup has already been consumed.<\/p>\n
Serialize state reads in futex_pivot_pending() using futex_mm_phash::lock.
\nThis guarantees that futex_pivot_pending() observes hash_new and hash
\natomically, eliminating the race condition.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
futex: Fix race in futex_pivot_pending() during private hash resize<\/p>\n
A task performing a custom private hash resize can remain bloc<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17280","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}