In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
null_blk: serialize configfs attribute updates with device setup<\/p>\n
The attribute store methods generated with NULLB_DEVICE_ATTR() refuse to
\nchange the configuration of a live device by testing
\nNULLB_DEV_FL_CONFIGURED, but that flag is only set by
\nnullb_device_power_store() after null_add_dev() has returned, and the
\nstore methods take no lock at all. configfs only serializes writes to
\nthe same open file (buffer->mutex), so a write to any attribute can run
\nconcurrently with null_add_dev() and change the device configuration
\nwhile it is being used.<\/p>\n
null_add_dev() reads the configuration several times, e.g. dev->zoned is
\nread once to set up the queue limits and once to initialize the zone
\nresources:<\/p>\n
CPU0: echo 1 > nullb0\/power CPU1: echo 1 > nullb0\/zoned
\n nullb_device_power_store()
\n mutex_lock(&lock)
\n null_add_dev()
\n if (dev->zoned) -> false
\n \/* no BLK_FEAT_ZONED *\/ nullb_device_zoned_store()
\n test_bit(FL_CONFIGURED) -> 0
\n dev->zoned = true
\n blk_mq_alloc_disk()
\n \/* queue is not zoned *\/
\n if (nullb->dev->zoned) -> true
\n null_register_zoned_dev()
\n blk_revalidate_disk_zones()<\/p>\n
blk_revalidate_disk_zones() is then called for a queue that does not
\nhave BLK_FEAT_ZONED set, which triggers its WARN_ON_ONCE() and fails the
\ndevice setup with -EIO:<\/p>\n
WARNING: CPU: 2 PID: 322 at block\/blk-zoned.c:2357 blk_revalidate_disk_zones+0x4c\/0x560<\/p>\n
Clearing dev->zoned in the same window is worse: the queue is created
\nwith BLK_FEAT_ZONED but the zone resources are never initialized, so
\nadd_disk() succeeds for a zoned disk that has no zones. And a store that
\nlands after the last dev->zoned test leaves dev->zoned set while
\ndev->zones is still NULL, which null_process_zoned_cmd() dereferences on
\nthe first write.<\/p>\n
Fix this by taking the global lock, which nullb_device_power_store()
\nalready holds across null_add_dev() and null_del_dev(), around both the
\nNULLB_DEV_FL_CONFIGURED test and the update of the device configuration.
\nThe submit_queues and poll_queues apply callbacks are now called with
\nthat lock held, so remove the locking they did themselves.<\/p>\n
Since the store methods can run as soon as configfs_register_subsystem()
\nreturns, that is, before null_init() gets to mutex_init(&lock), also
\ninitialize the lock statically with DEFINE_MUTEX().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
null_blk: serialize configfs attribute updates with device setup<\/p>\n
The attribute store methods generated with NULLB_DEVICE_ATTR() re<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25593","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25593","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25593"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25593"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25593"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}