In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: Check svc pool percpu counter allocation<\/p>\n
__svc_create() initializes three per-pool percpu_counter stats and
\nignores every return value. On SMP, percpu_counter_init() fails when
\n__alloc_percpu_gfp() cannot satisfy the allocation, leaving the failed
\ncounter with fbc->counters == NULL and its embedded raw_spinlock_t,
\nlist_head, and count never initialized. __svc_create() returns the
\nhalf-constructed svc_serv to nfsd, lockd, or the NFS callback service
\nanyway.<\/p>\n
Once that service is live, the hot-path increments in
\nsvc_xprt_enqueue(), svc_handle_xprt(), and
\nsvc_pool_wake_idle_thread() reach a counter whose backing pointer is
\nNULL. The pointer is a per-cpu offset, so the access does not fault:
\nit resolves to offset zero of the current CPU’s per-cpu area and
\nsilently corrupts whatever variable lives there. A
\n\/proc\/fs\/nfsd\/pool_stats read walks the same NULL per-cpu storage and
\nreturns garbage, and on CONFIG_DEBUG_SPINLOCK or lockdep it splats on
\nthe never-initialized lock.<\/p>\n
Creating the broken service requires a percpu allocation failure during
\nRPC server startup, so it is reachable only by a local administrator
\nunder memory pressure or fault injection; a remote peer cannot induce
\nthe bad state on its own.<\/p>\n
Check each percpu_counter_init() return value in __svc_create() and
\nfail when an allocation fails, unwinding the counters already set up
\nin the current pool and in every pool initialized before it. A
\ndiscrete percpu_counter_destroy() per counter at teardown frees each
\nper-cpu allocation exactly once.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: Check svc pool percpu counter allocation<\/p>\n
__svc_create() initializes three per-pool percpu_counter stats and
\nignores every <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21469","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21469","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21469"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21469"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21469"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}