In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE\/WRITE_ONCE<\/p>\n
xprtsock replaces and restores sk->sk_data_ready and
\nsk->sk_write_space on live sockets with plain stores, and
\nxs_udp_do_set_buffer_size() invokes sk->sk_write_space via a plain
\nload. These callback pointers are shared with generic socket and
\nprotocol paths that may read or invoke them concurrently, so xprtsock
\nneeds the same READ_ONCE()\/WRITE_ONCE() callback visibility contract
\nthat the validated 4022 family applied elsewhere.<\/p>\n
When SUNRPC takes over an AF_LOCAL, UDP, or TCP socket and later
\nrestores the lower-socket callbacks during teardown, another CPU may
\nstill hold an earlier callback snapshot. The plain replace\/restore
\npattern leaves the same visibility hole as the validated 4022 family,
\nso a stale snapshot can still invoke xs_data_ready() or
\nxs_udp_write_space() after the live callback fields have already been
\nrestored to the lower-socket handlers.<\/p>\n
Use WRITE_ONCE() for the shared sk_data_ready and sk_write_space
\nstores in xs_local_finish_connecting(), xs_udp_finish_connecting(),
\nxs_tcp_finish_connecting(), and xs_restore_old_callbacks(). Use
\nREAD_ONCE() for the direct sk_write_space invocation in
\nxs_udp_do_set_buffer_size(). This matches the required callback
\nvisibility contract while leaving adjacent sk_state_change and
\nsk_error_report handling unchanged.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE\/WRITE_ONCE<\/p>\n
xprtsock replaces and restores sk->sk_data_ready and<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25644","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25644","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25644"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25644"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25644"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}