In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvmet: fix max_qid race between configfs and controller allocation<\/p>\n
The function nvmet_subsys_attr_qid_max_store() can race against
\nnvmet_alloc_ctrl() when a subsystem’s max_qid limit is modified.<\/p>\n
Suppose max_qid is currently 64. If nvmet_alloc_ctrl() executes:
\nctrl->sqs = kzalloc_objs(struct nvmet_sq *, subsys->max_qid + 1);
\nand at this exact point, a userspace process changes max_qid to 128,
\nnvmet_subsys_attr_qid_max_store() will set the new max_qid value. It
\nattempts to delete active controllers to force a reconnect, but the
\nnew controller won’t be deleted because it hasn’t been added to the
\nsubsys->ctrls list yet.<\/p>\n
nvmet_alloc_ctrl() then proceeds and adds the new controller to the
\nsubsys->ctrls list. Later, when nvmet_install_queue() is called, it
\nwill see max_qid set to 128, but the memory allocated for sqs is only
\nsized for 64 entries. This results in a KASAN out-of-bounds warning
\nand potential memory corruptions.<\/p>\n
Fix this by protecting the queue allocations and list insertion in
\nnvmet_alloc_ctrl() with down_read(&nvmet_config_sem). Because
\nnvmet_subsys_attr_qid_max_store() acquires down_write(&nvmet_config_sem)
\nto modify the attribute, this safely prevents the configfs writer from
\nmodifying max_qid during controller creation.<\/p>\n
Copy the max_qid from the subsystem to the controller’s structure
\nduring the allocation; ctrl->max_qid never changes as long as the
\ncontroller remains in LIVE state, so this will prevent similar race
\nconditions.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvmet: fix max_qid race between configfs and controller allocation<\/p>\n
The function nvmet_subsys_attr_qid_max_store() can race against<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25615","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25615","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25615"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25615"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25615"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}