In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: close backchannel before destroying callback service<\/p>\n
A backchannel receive can complete a request while the NFS callback
\nservice is being torn down. xprt_complete_bc_request() removes the
\nrequest from bc_pa_list, drops bc_alloc_count, marks the request in use,
\nand then asks xprt_enqueue_bc_request() to hand it to the callback
\nservice.<\/p>\n
If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_request()
\ncurrently returns without enqueueing or freeing the committed request.
\nThe xprt_get() taken on entry is leaked as well. If the producer wins
\nthe race before bc_serv is cleared, it can also enqueue onto sv_cb_list
\nafter nfs_callback_down() has stopped the callback threads, leaving the
\nrequest linked to a svc_serv that is about to be freed.<\/p>\n
Close the producer side before callback threads are stopped. Add
\nxprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock, and call
\nit on callback shutdown and callback-start failure before stopping the
\nservice threads. Requests that lose the NULL transition in
\nxprt_enqueue_bc_request() are released through the normal backchannel
\nfree path after balancing bc_slot_count. Finally, drain any remaining
\nsv_cb_list requests after the callback threads have stopped and before
\nsvc_destroy() frees the service.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: close backchannel before destroying callback service<\/p>\n
A backchannel receive can complete a request while the NFS callback
\ns<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21468","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21468","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21468"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21468"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21468"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}