In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering<\/p>\n
This patch is a follow-up to commit cf070fe33bfb (“can: isotp: serialize
\nTX state transitions under so->rx_lock”) which addresses following
\nsashiko-bot findings:<\/p>\n
– isotp_sendmsg(): drain so->txfrtimer first so a stale callback can’t
\n re-arm echotimer after the claim<\/p>\n
– isotp_release(): wake so->wait after forcing ISOTP_SHUTDOWN so a
\n sleeping sendmsg() claim isn’t stranded<\/p>\n
– isotp_sendmsg(): have both wait_event_interruptible() calls in
\n isotp_sendmsg() also wake on ISOTP_SHUTDOWN and do not return claim to
\n IDLE to avoid corrupting a concurrent isotp_release() process.<\/p>\n
– isotp_sendmsg(): handle potential claim of a new transfer when
\n the wait_event_interruptible() call returns in CAN_ISOTP_WAIT_TX_DONE
\n mode. Don’t touch timers and states of the new transfer if a new thread
\n incremented so->tx_gen before getting the lock at err_event_drop.<\/p>\n
– isotp_sendmsg(): handle a stuck can_send() and omit timer and state
\n changes if a new transfer was claimed. wait_tx_done() returns the error
\n recorded in so->tx_result[], tagged with the caller’s own generation.<\/p>\n
– isotp_tx_timeout(): on a claimed timeout, record the ECOMM error for
\n the timed-out transfer’s own generation in so->tx_result[]; sk->sk_err
\n is raised unconditionally, same as every other error path here.<\/p>\n
– isotp_tx_gen_done()\/isotp_tx_timeout(): always read tx.state (acquire)
\n before tx_gen – the reverse order let a weakly ordered CPU pair a fresh
\n tx.state with a stale tx_gen\/tx_result slot.<\/p>\n
– isotp_sendmsg(): wait_tx_done: drain sk_err via sock_error() once we
\n have read the result from so->tx_result[], so an already-reported error
\n doesn’t stay latched for a later poll()\/SO_ERROR.<\/p>\n
Also align the remaining lock-free so->tx.state\/rx.state\/cfecho accesses
\nand use skb->hash as unique loopback echo frame indicator.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering<\/p>\n
This patch is a follow-up to commit cf070fe33bfb (“can: iso<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17469","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17469","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17469"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17469"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17469"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}