In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ublk: avoid teardown retry loop on xarray allocation failure<\/p>\n
__ublk_shmem_remove_ranges() removes matching maple tree ranges in
\nbatches, but first stores each range into a temporary xarray so that the
\npages can be unpinned after dropping the maple tree lock.<\/p>\n
That temporary xarray is filled under the maple tree lock with
\nxa_store(…, GFP_ATOMIC). If the store fails before mas_erase(), the
\ncurrent range is left in the tree and the helper returns false. The
\nouter ublk_shmem_remove_ranges() loop then immediately retries the same
\nrange. While the atomic allocation keeps failing, the teardown path has
\nno forward progress.<\/p>\n
The issue can be reproduced with radix_tree_node failslab injection after
\na SHMEM_ZC buffer has already been registered:<\/p>\n
# Kernel config:
\n # CONFIG_BLK_DEV_UBLK=y
\n # CONFIG_DEBUG_FS=y
\n # CONFIG_FAULT_INJECTION=y
\n # CONFIG_FAULT_INJECTION_DEBUG_FS=y
\n # CONFIG_FAILSLAB=y<\/p>\n
echo 10 > \/proc\/sys\/vm\/nr_hugepages
\n mkdir -p \/tmp\/htlb
\n mount -t hugetlbfs none \/tmp\/htlb
\n fallocate -l 4M \/tmp\/htlb\/ublk_buf<\/p>\n
dev_id=$(kublk add -t null –shmem_zc
\n\t\t–htlb \/tmp\/htlb\/ublk_buf |
\n\t awk -F ‘[ :]’ ‘\/dev id\/ {print $3}’)<\/p>\n
echo 1 > \/sys\/kernel\/slab\/radix_tree_node\/failslab
\n echo Y > \/sys\/kernel\/debug\/failslab\/cache-filter
\n echo Y > \/sys\/kernel\/debug\/failslab\/ignore-gfp-wait
\n echo 1 > \/sys\/kernel\/debug\/failslab\/interval
\n echo -1 > \/sys\/kernel\/debug\/failslab\/times
\n echo 100 > \/sys\/kernel\/debug\/failslab\/probability<\/p>\n
kublk del -n “$dev_id”<\/p>\n
On the unfixed kernel the delete command was still running after 3
\nseconds. Disabling failslab made it return. The fault-injection stack
\nshowed:<\/p>\n
should_failslab
\n kmem_cache_alloc_lru_noprof
\n __xas_nomem
\n __xa_store
\n xa_store
\n __ublk_shmem_remove_ranges
\n ublk_cdev_rel
\n ublk_ctrl_del_dev<\/p>\n
Remove the allocation from the teardown loop. Keep the existing batch
\nlimit, but collect {base_pfn, nr_pages} pairs in a fixed-size stack array.
\nOnce a matching range is found, the range is erased from the maple tree
\nbefore dropping the lock, so each successful scan makes progress without
\ndepending on any GFP_ATOMIC allocation.<\/p>\n
With the same failslab settings, the fixed kernel completed
\n“kublk del -n $dev_id” successfully in about 45 ms.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ublk: avoid teardown retry loop on xarray allocation failure<\/p>\n
__ublk_shmem_remove_ranges() removes matching maple tree ranges in
\nba<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25590","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25590","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25590"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25590"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25590"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}