In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
null_blk: serialize configfs attribute stores with the lock<\/p>\n
The NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes
\n(submit_queues, poll_queues) get dev->NAME written again after apply_fn
\nreturns, outside its lock; APPLY=NULL attributes are entirely lockless.
\nconfigfs only serializes stores per-open-file, so concurrent stores on
\nseparate fds race.<\/p>\n
For apply_fn attributes, once one store’s apply_fn has reconfigured the
\nhardware, a second (losing) store can still overwrite dev->NAME
\nafterwards. This leaves dev->submit_queues out of sync with the live
\nqueue count, which is later caught by the WARN_ON_ONCE() in
\nnull_map_queues().<\/p>\n
For !apply_fn attributes, power_store()’s null_add_dev() validates and
\nbuilds the device under “lock” but only sets CONFIGURED afterwards. A store
\nslipping in during this window can change a field mid-setup — for example,
\nzone_nr_conv can be pushed above nr_zones after it has already been
\nclamped, leading to an out-of-bounds dev->zones[] access.<\/p>\n
Take “lock” in the macro around the apply_fn call, the CONFIGURED test and
\nthe field write, and move it out of nullb_apply_submit_queues()\/
\nnullb_apply_poll_queues() so both paths are covered once. This serializes
\nstores with power_store’s setup and with each other.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
null_blk: serialize configfs attribute stores with the lock<\/p>\n
The NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes
\n(submi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25594","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25594","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25594"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25594"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25594"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}