In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition<\/p>\n
When smc_llc_event_handler() transitions the local LLC flow from
\nSMC_LLC_FLOW_REQ_ADD_LINK to SMC_LLC_FLOW_ADD_LINK on arrival of an ADD_LINK
\nrequest, it calls smc_llc_flow_qentry_set() unconditionally:<\/p>\n
\tif (lgr->llc_flow_lcl.type == SMC_LLC_FLOW_REQ_ADD_LINK) {
\n\t\tlgr->llc_flow_lcl.type = SMC_LLC_FLOW_ADD_LINK;
\n\t\tsmc_llc_flow_qentry_set(&lgr->llc_flow_lcl, qentry);
\n\t\t…
\n\t}<\/p>\n
A CONFIRM_LINK or ADD_LINK_CONT arriving while flow->type is
\nSMC_LLC_FLOW_REQ_ADD_LINK is stashed into flow->qentry via the
\nSMC_LLC_CONFIRM_LINK \/ SMC_LLC_ADD_LINK_CONT handler (which stores into
\nflow->qentry for any non-NONE flow type). When the subsequent ADD_LINK
\narrives, the REQ_ADD_LINK branch overwrites flow->qentry with the new pointer
\nwithout first freeing the stashed allocation, leaking one kmalloc object.<\/p>\n
The stashed entry has no consumer: smc_llc_wait() is only called from
\nllc_add_link_work, which is not yet scheduled while the flow type remains
\nREQ_ADD_LINK. No waiter is sleeping on llc_msg_waiter at this point.
\nIt is safe to unconditionally free any stashed qentry before
\nthe overwrite.<\/p>\n
Call smc_llc_flow_qentry_del() before smc_llc_flow_qentry_set() in the
\nREQ_ADD_LINK branch. smc_llc_flow_qentry_del() already checks flow->qentry
\nbefore freeing, so the normal path where no entry is stashed is a no-op.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition<\/p>\n
When smc_llc_event_handler() transitions the <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25517","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25517","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25517"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25517"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25517"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}