In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
s390\/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects<\/p>\n
In order to traverse or add\/remove ap_matrix_mdev objects in the
\nmatrix_dev->mdev_list, the matrix_dev->guests_lock mutex must be held.
\nThere are two functions that access the list without holding the mutex:<\/p>\n
vfio_ap_mdev_probe function
\n~~~~~~~~~~~~~~~~~~~~~~~~~~~
\nThe vfio_ap_mdev_probe function uses the matrix_dev->mdevs_lock
\nmutex to guard the add of a newly created ap_matrix_mdev object to the
\nmatrix_dev->mdev_list. This mutex does not protect list access; its purpose
\nis to guard against concurrent access to fields contained in an
\nap_matrix_mdev object. This could lead to kernel memory corruption or
\nuse-after-free if another mdev is created or removed concurrently.<\/p>\n
The adding of an ap_matrix_mdev object to matrix_dev->mdev_list
\nis now guarded by the matrix_dev->guests_lock which is the correct
\nway to protect against concurrent mdev_list access.<\/p>\n
Also removed the following two lines of code because the matrix_mdev is
\nallocated via vfio_alloc_device macro which uses kzalloc, so req_trigger
\nand cfg_chg_trigger are already zero-initialised when the struct is
\nallocated before the call to vfio_register_emulated_iommu_dev. This
\nprevents a window whereby these triggers are set to NULL after
\nthe device is exposed to userspace.<\/p>\n
matrix_mdev->req_trigger = NULL;
\nmatrix_mdev->cfg_chg_trigger = NULL;<\/p>\n
vfio_ap_mdev_for_queue function
\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
\nThe status_show function that supports display of the status attribute of
\nthe devices in \/sys\/bus\/ap\/devices calls the vfio_ap_mdev_for_queue
\nfunction which iterates the matrix_dev->mdev_list to find the object
\nrepresenting the queue device whose status is to be displayed. In order to
\ntraverse this list, the matrix_dev->guests_lock mutex must be held.<\/p>\n
To fix this, the guests_lock mutex is taken prior to taking the
\nmatrix_dev->mdevs_lock mutex in the status_show function. It is taken
\nthere rather than the vfio_ap_mdev_for_queue function – where it is
\nneeded – because it must be taken prior to the mdevs_lock mutex in order to
\nadhere to the proper locking order and prevent a lockdep splat; also
\nbecause the mdevs_lock is needed there to access fields within
\nthe matrix_mdev object in that function.<\/p>\n
See the vfio-ap-locking.rst in the linux kernel tree.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
s390\/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects<\/p>\n
In order to traverse or add\/remove ap_matrix_mdev<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24643","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24643","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24643"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24643"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24643"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}