In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/ucma: Lock the handler in ucma_set_ib_path()<\/p>\n
ucma_set_ib_path() calls ucma_event_handler() straight from the write()
\npath, without the handler lock that keeps ctx->file stable while a uevent
\nis queued. The handler re-reads ctx->file for every dereference:<\/p>\n
\tmutex_lock(&ctx->file->mut);\t\t\t\/* file A *\/
\n\tlist_add_tail(&uevent->list, &ctx->file->event_list);\t\/* file B *\/
\n\tmutex_unlock(&ctx->file->mut);\t\t\t\/* file B *\/
\n\twake_up_interruptible(&ctx->file->poll_wait);\t\/* file B *\/<\/p>\n
A concurrent ucma_migrate_id() reassigns ctx->file while the SET_OPTION
\ncaller sleeps in mutex_lock(), so the list_add_tail() lands on file B’s
\nevent_list while only file A’s mutex is held, racing every other user of
\nthat list:<\/p>\n
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x1aa\/0x1c0
\n Read of size 8 at addr ffff888153c6a418 by task poc_corr\/486
\n Call Trace:
\n __list_add_valid_or_report+0x1aa\/0x1c0
\n ucma_event_handler+0x1be\/0xc00
\n ucma_set_ib_path+0x45e\/0x710
\n ucma_set_option+0x32e\/0x590
\n ucma_write+0x1f9\/0x330
\n Allocated by task 505:
\n ucma_write_cm_event+0x1a1\/0x660
\n Freed by task 505:
\n kfree+0x1da\/0x4c0
\n ucma_get_event+0x5d5\/0x7e0<\/p>\n
The freed object is a ucma_event that another thread dequeued from file B’s
\nlist under file B’s mutex. File A’s mut is left held on top of that,
\nwedging its next writer in uninterruptible sleep.<\/p>\n
This path needs a bound and address-resolved cm_id, so it requires an RDMA
\ndevice to be present.<\/p>\n
Take the handler lock around the call.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/ucma: Lock the handler in ucma_set_ib_path()<\/p>\n
ucma_set_ib_path() calls ucma_event_handler() straight from the write()
\npath, wi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21430","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}