In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock<\/p>\n
nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with
\nlist_for_each_entry_safe(ni, tmp, …). For each expired entry it
\nsets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the
\nsource vfsmount, then reacquires the lock to list_del + kfree the
\nentry and continue iterating via the macro’s saved tmp pointer.<\/p>\n
The nsui_busy flag protects the current ni from concurrent
\nnfsd4_ssc_setup_dul() finders during the lock-drop window, but it
\ndoes not pin tmp. Another nfsd RPC thread that fails its source-
\nserver mount and reaches nfsd4_ssc_cancel_dul() will, during that
\nsame window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount
\nitem, and release the lock. If that item is the saved tmp of the
\nexpire walk, the next iteration dereferences a freed
\nnfsd4_ssc_umount_item.<\/p>\n
Restart the walk from the head after the mntput() unlock window so
\nno saved next pointer survives the lock-drop. The list is bounded
\nby the number of active inter-server source mounts (typically small)
\nand the expire delayed-work runs periodically rather than per-IO,
\nso the restart is cheap.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock<\/p>\n
nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with
\nlis<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21634","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21634","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}