In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2\/cluster: keep heartbeat local node stable<\/p>\n
o2nm_node_local_store() handles local=0 by stopping o2net and setting
\ncl_local_node to O2NM_INVALID_NODE_NUM, but it leaves cl_has_local set.
\nThat stale state makes o2nm_this_node() return 255, blocks a later local=1
\nattempt with -EBUSY, and can feed 255 to heartbeat users that call
\no2nm_this_node() dynamically.<\/p>\n
Clearing cl_has_local is required when the local node is reset. But
\nheartbeat threads can still be running at that point. They pin the local
\nnode config item at startup, yet o2hb_do_disk_heartbeat() and thread
\nteardown re-read o2nm_this_node() for the local slot and for
\no2nm_undepend_this_node(). Once local=0 has cleared the live local-node
\nstate, those dynamic reads return O2NM_MAX_NODES, which is also the
\ninvalid node number 255.<\/p>\n
Store the local node number in the heartbeat region when the region
\nstarts. Use that stable node for heartbeat slot writes\/checks,
\nnegotiation messages, and the final configfs undepend. Stop the heartbeat
\nloop when the current local node no longer matches the stored node, and
\nclear cl_has_local together with cl_local_node in the local=0 path so
\nnodemanager state matches node removal.<\/p>\n
Validation reproduced this kernel report:
\nKASAN slab-out-of-bounds in o2hb_do_disk_heartbeat+0x372\/0xb30
\nRIP: 0010:memset+0xf\/0x20
\nRead of size 8
\nCall trace:
\n dump_stack_lvl+0x66\/0xa0
\n print_report+0xd0\/0x630
\n o2hb_do_disk_heartbeat+0x372\/0xb30 (fs\/ocfs2\/cluster\/heartbeat.c:1079)
\n srso_alias_return_thunk+0x5\/0xfbef5
\n __virt_addr_valid+0x188\/0x2f0
\n kasan_report+0xe4\/0x120
\n o2hb_do_disk_heartbeat+0x5\/0xb30 (fs\/ocfs2\/cluster\/heartbeat.c:1079)
\n o2hb_thread+0x14e\/0x770
\n kthread_affine_node+0x139\/0x180
\n lockdep_hardirqs_on_prepare+0xda\/0x190
\n trace_hardirqs_on+0x18\/0x130
\n kthread+0x19d\/0x1e0
\n ret_from_fork+0x37a\/0x4d0
\n __switch_to+0x2d5\/0x6f0
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2\/cluster: keep heartbeat local node stable<\/p>\n
o2nm_node_local_store() handles local=0 by stopping o2net and setting
\ncl_local_nod<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25731","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25731","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25731"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25731"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25731"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}