In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/packet: defer vmalloc TX_RING free until skbs finish<\/p>\n
AF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb
\npage references preserve page-backed ring blocks after pg_vec is freed,
\nbut they do not preserve a vmalloc mapping.<\/p>\n
tpacket_destruct_skb() currently drops the pending reference before
\nwriting the timestamp and TP_STATUS_AVAILABLE to the frame. Move the
\ndecrement after those stores. The smp_wmb() in __packet_set_status()
\norders the frame stores before the decrement.<\/p>\n
Also recheck pending TX frames under pg_vec_lock before non-closing
\nring replacement, so a racing send cannot add a pending skb between
\nthe initial check and the ring swap.<\/p>\n
Ring allocation can produce a mixture of page-backed and vmalloc-backed
\nblocks. Allocate deferred-work storage during TX ring setup when the
\nfirst vmalloc-backed block is encountered, and keep its pointer in the
\npg_vec allocation header. If allocation fails, return -ENOMEM from ring
\nsetup. On socket close, a non-NULL pointer identifies a vmalloc-backed
\nvector without a scan. If TX skbs remain, defer the whole vector to
\nsystem_long_wq.<\/p>\n
After pg_vec is detached, a late destructor can skip the pending
\ndecrement. Use socket write-memory accounting as the deferred lifetime
\ngate instead: an skb remains charged through its final sock_wfree(),
\nafter all ring-frame accesses. The delayed work retains a socket
\nreference and reschedules itself until no TX skbs remain.<\/p>\n
Move pending_refcnt release to packet_sock_destruct() so late skb
\ndestructors and deferred cleanup can safely use it after
\npacket_release(). Page-backed teardown remains synchronous, and no lock
\nis added to the TX completion hot path.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/packet: defer vmalloc TX_RING free until skbs finish<\/p>\n
AF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb
\npa<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17345","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17345","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17345"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17345"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17345"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}