In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
md\/md-llbitmap: stop daemon timer rearm on destroy<\/p>\n
llbitmap_destroy() deletes pending_timer before flushing
\nmd_llbitmap_io_wq. However, daemon_work can still be queued or running
\nafter the timer has been deleted, and the daemon path can arm
\npending_timer again when it finds dirty chunks that are not ready to
\nflush yet.<\/p>\n
If that happens during teardown, pending_timer can remain armed after
\nllbitmap is freed and later dereference freed memory.<\/p>\n
Add a BITMAP_SHUTDOWN bit to llbitmap->flags, set it before deleting
\nthe timer, and make the timer and daemon paths stop queueing or rearming
\nwork once teardown starts. Cancel daemon_work before flushing the shared
\nworkqueue so no already queued daemon instance can race with the free.
\nUse timer_shutdown_sync() so a daemon instance that passed the shutdown
\ncheck before teardown cannot rearm the timer afterward.<\/p>\n
BITMAP_SHUTDOWN is a runtime-only state. Mask it out when reading and
\nupdating the llbitmap superblock so the shutdown state is never loaded
\nfrom disk or persisted to disk.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
md\/md-llbitmap: stop daemon timer rearm on destroy<\/p>\n
llbitmap_destroy() deletes pending_timer before flushing
\nmd_llbitmap_io_wq. How<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25685","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25685","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25685"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25685"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25685"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}