In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/rds: use wq_has_sleeper() in rds_cong_map_updated()<\/p>\n
rds_cong_map_updated() runs after a peer’s congestion map has been
\nrewritten (by rds_tcp_cong_recv() and rds_ib_cong_recv(), or the
\nclear-all in the loopback and IB send-completion paths). It bumps
\nrds_cong_generation and then checks waitqueue_active() on
\nmap->m_waitq and on rds_poll_waitq to decide whether anyone needs
\nwaking. atomic_inc() carries no ordering and waitqueue_active() is a
\nplain load, so nothing orders the map and generation stores before
\nthe wait queue reads. The waiters do the mirror image: rds_cong_wait()
\nadds itself to m_waitq and then tests the port bit, and rds_poll()
\nregisters on rds_poll_waitq and then reads the generation. That is
\nthe store-buffering pattern described above waitqueue_active() in
\ninclude\/linux\/wait.h – the updater can observe an empty wait queue
\nwhile the waiter still observes the port as congested, and no wake-up
\nis issued.<\/p>\n
rds_cong_wait() is an interruptible sleep with no timeout, so a
\nsender blocked on a congested port stays blocked until the next
\ncongestion update from that peer arrives or a signal is delivered.
\nA poll() waiter misses the map-updated notification the same way.<\/p>\n
Use wq_has_sleeper(), which is waitqueue_active() preceded by the
\nrequired full barrier, as rds_tcp_state_change() already does for
\nthe same pattern.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/rds: use wq_has_sleeper() in rds_cong_map_updated()<\/p>\n
rds_cong_map_updated() runs after a peer’s congestion map has been
\nrewritt<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25490","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25490","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25490"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25490"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25490"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}