In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
rpcrdma: arm rn_done before publishing the notification<\/p>\n
rpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before
\nstoring the caller’s callback in rn->rn_done. The xarray makes @rn
\nreachable to rpcrdma_remove_one(), which walks rd_xa and invokes
\nrn->rn_done(rn) for every registered notification. A device removal
\nthat races a fresh registration can therefore observe @rn with
\nrn_done still NULL, because the notification objects are zero
\nallocated by their owners, and call through a NULL function pointer.<\/p>\n
Store rn->rn_done before xa_alloc() publishes @rn. The xarray’s
\nstore-side and load-side ordering then guarantees that any CPU which
\nfinds @rn in rd_xa also observes the armed callback.<\/p>\n
rpcrdma_rn_unregister() treats a non-NULL rn_done as the sentinel
\nfor a completed registration, so the early store must not survive a
\nfailed registration. Clear rn_done again when xa_alloc() fails.
\nWere it left set, the failed-accept cleanup path would call
\nrpcrdma_rn_unregister() on an @rn that was never inserted, erasing
\nan unrelated rd_xa slot and underflowing rd_kref.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
rpcrdma: arm rn_done before publishing the notification<\/p>\n
rpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before
\nstorin<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24485","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24485"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}