In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: f_tcm: keep port count until LUN teardown completes<\/p>\n
tcm_usbg_drop_nexus() permits session removal once tpg_port_count
\nreaches zero. However, usbg_port_unlink() currently decrements that
\ncount from the fabric_pre_unlink() callback, before core_dev_del_lun()
\nwaits for active se_lun references to drain.<\/p>\n
If removal of the last LUN races a nexus removal, the latter can observe
\na zero port count and call target_remove_session(). This frees
\nsess_cmd_map while an in-flight struct usbg_cmd, including its work item,
\ncan still be accessed.<\/p>\n
Overlapping the last-LUN unlink with nexus removal reproduces this
\nlifetime violation as a DEBUG_OBJECTS “free active” warning for
\nusbg_cmd_work, followed by a target-core BUG\/Oops.<\/p>\n
The generic target-core unlink path has no callback after
\ncore_dev_del_lun() completes. Add an optional fabric_post_unlink()
\ncallback and use it for the f_tcm port count. The count now remains
\nnonzero until core_dev_del_lun() has finished draining active LUN
\nreferences, preventing nexus removal from freeing the session during
\ncommand completion.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: f_tcm: keep port count until LUN teardown completes<\/p>\n
tcm_usbg_drop_nexus() permits session removal once tpg_port_count<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17358","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17358","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17358"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17358"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17358"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}