In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: synchronize heartbeat callbacks with o2net teardown<\/p>\n
Patch series “ocfs2: harden heartbeat teardown races”.<\/p>\n
This series fixes two OCFS2 heartbeat\/o2net teardown races found by
\nKASAN.<\/p>\n
This patch (of 2):<\/p>\n
Heartbeat callbacks stay registered while configfs local-node teardown
\nenters o2net_stop_listening(). A node-down event can still run through
\no2net_disconnect_node() and o2net_set_nn_state() while teardown is
\ndestroying o2net_wq, so the later queue\/flush operations can hit a dead
\nworkqueue. KASAN has caught this as a slab-use-after-free in
\n__queue_work() with the call chain:<\/p>\n
KASAN slab-use-after-free in __queue_work+0x56\/0xa90
\nRead of size 4
\nCall trace:
\n dump_stack_lvl+0x66\/0xa0
\n print_report+0xce\/0x630
\n __queue_work+0x56\/0xa90
\n srso_alias_return_thunk+0x5\/0xfbef5
\n __virt_addr_valid+0x19f\/0x330
\n kasan_report+0xe0\/0x110
\n __queue_delayed_work+0x58\/0x1e0
\n queue_delayed_work_on+0xb4\/0xc0
\n o2net_set_nn_state+0x467\/0x840
\n o2net_disconnect_node+0x7b\/0xe0
\n o2net_hb_node_down_cb+0x54\/0x60
\n o2hb_run_event_list+0x236\/0x2d0
\n o2hb_check_slot+0xad4\/0xbc0
\n lock_release+0xc8\/0x290
\n o2hb_check_slot+0x9ea\/0xbc0
\n trace_hardirqs_on+0x18\/0x130
\n o2hb_do_disk_heartbeat+0x646\/0xb30 (fs\/ocfs2\/cluster\/heartbeat.c:1079)
\n __lock_acquire+0x466\/0x2260
\n lockdep_hardirqs_on_prepare+0xea\/0x1a0
\n ktime_get_with_offset+0xe9\/0x230
\n o2hb_thread+0x14e\/0x770
\n kthread+0x1ad\/0x1f0
\n ret_from_fork+0x3c9\/0x540
\n __switch_to+0x2e9\/0x730
\n ret_from_fork_asm+0x1a\/0x30
\nAllocated by task stack:
\n kasan_save_stack+0x33\/0x60
\n kasan_save_track+0x14\/0x30
\n __kasan_kmalloc+0xaa\/0xb0
\n __kmalloc_noprof+0x292\/0x760
\n __alloc_workqueue+0x736\/0xc60
\n alloc_workqueue_noprof+0xb1\/0x110
\n o2net_start_listening+0xe5\/0x430
\n o2nm_node_local_store+0x184\/0x310
\n configfs_write_iter+0x18a\/0x210
\n vfs_write+0x469\/0x810
\n ksys_write+0xd2\/0x170
\n do_syscall_64+0x115\/0x6a0 (arch\/x86\/entry\/syscall_64.c:87)
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f
\nFreed by task stack:
\n kasan_save_stack+0x33\/0x60
\n kasan_save_track+0x14\/0x30
\n kasan_save_free_info+0x3b\/0x60
\n __kasan_slab_free+0x5f\/0x80
\n kfree+0x313\/0x590
\n rcu_core+0x4f4\/0x1320
\n handle_softirqs+0x156\/0x660<\/p>\n
queue_delayed_work_on
\no2net_set_nn_state
\no2net_disconnect_node
\no2net_hb_node_down_cb
\no2hb_run_event_list<\/p>\n
Keep heartbeat callbacks registered so quorum state still tracks node
\nstate, but stop them from driving o2net reconnect\/disconnect work once
\nlocal teardown starts. Mark the transport offline before destroying
\no2net_wq, wait for any in-flight heartbeat callback to finish, and delay
\nbring-up replay until the new local node is published through
\no2nm_this_node().<\/p>\n
The replay also has to stay serialized with heartbeat callback delivery.
\nOtherwise a live-node snapshot can be copied, a real hb_down callback
\ncan install -ENOTCONN for a peer, and the stale replay can call
\no2net_hb_node_up() for that same peer and queue reconnect work even
\nthough heartbeat is already down.<\/p>\n
The buggy scenario involves two paths, with each column showing the order
\nwithin that path:<\/p>\n
local-node teardown: heartbeat node-down callback:
\n1. configfs local-off enters 1. o2hb_run_event_list() invokes
\n o2net_stop_listening(). o2net_hb_node_down_cb().
\n2. teardown heads for 2. the callback reaches
\n destroy_workqueue(o2net_wq). o2net_disconnect_node() and
\n o2net_set_nn_state().
\n3. teardown destroys and NULLs 3. the callback flushes or queues
\n o2net_wq. work through o2net_wq.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: synchronize heartbeat callbacks with o2net teardown<\/p>\n
Patch series “ocfs2: harden heartbeat teardown races”.<\/p>\n
This series fix<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25711","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}