In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/ucma: Lock the handler in ucma_write_cm_event()<\/p>\n
ctx->file may only be changed under the handler lock and the xa_lock, which
\nis what stops uevents being queued for a ctx while ucma_migrate_id() moves
\nit to another file. The CM core takes that lock before invoking
\nucma_event_handler(), but the write() paths that queue uevents themselves
\ndo not.<\/p>\n
ucma_write_cm_event() re-reads ctx->file for each of its four dereferences,
\nso ucma_migrate_id() can swap it mid-sequence:<\/p>\n
\tmutex_lock(&ctx->file->mut);\t\t\t\/* file A *\/
\n\tlist_add_tail(&uevent->list, &ctx->file->event_list);\t\/* file B *\/
\n\tmutex_unlock(&ctx->file->mut);\t\t\t\/* file B *\/
\n\twake_up_interruptible(&ctx->file->poll_wait);\t\/* file B *\/<\/p>\n
The window is the mutex_lock() itself: the writer sleeps in it while the
\nmigration reassigns ctx->file. The list_add_tail() then runs on file B’s
\nevent_list holding only file A’s mutex:<\/p>\n
list_add corruption. prev->next should be next (ffff888101320f30),
\n but was ffff88814a08c418. (prev=ffff88814a075c18).
\n kernel BUG at lib\/list_debug.c:32!
\n Call Trace:
\n ucma_write_cm_event+0x36e\/0x5e0<\/p>\n
and file A’s mut is left held forever, wedging its next writer in D state.
\nThe uevent is also stranded on a list ucma_cleanup_ctx_events() will not
\nwalk, so it outlives its context. \/dev\/infiniband\/rdma_cm is 0666 and no
\nRDMA device is involved, so an unprivileged user reaches all of this.<\/p>\n
Take the handler lock, as ucma_cleanup_mc_events() does; ctx->cm_id is
\npinned by the ucma_get_ctx() reference.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/ucma: Lock the handler in ucma_write_cm_event()<\/p>\n
ctx->file may only be changed under the handler lock and the xa_lock, which
\ni<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21429","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21429","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21429"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21429"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21429"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}