In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
blk-cgroup: skip dying blkg in blkcg_activate_policy()<\/p>\n
When switching IO schedulers on a block device, blkcg_activate_policy()
\ncan race with concurrent blkcg deletion, leading to a use-after-free in
\nrcu_accelerate_cbs.<\/p>\n
T1: T2:
\n blkg_destroy
\n kill(&blkg->refcnt) \/\/ blkg->refcnt=1->0
\n blkg_release \/\/ call_rcu(__blkg_release)
\n …
\n blkg_free_workfn
\n ->pd_free_fn(pd)
\nelv_iosched_store
\nelevator_switch
\n…
\niterate blkg list
\nblkg_get(blkg) \/\/ blkg->refcnt=0->1
\n list_del_init(&blkg->q_node)
\nblkg_put(pinned_blkg) \/\/ blkg->refcnt=1->0
\nblkg_release \/\/ call_rcu again
\nrcu_accelerate_cbs \/\/ uaf<\/p>\n
Fix this by checking hlist_unhashed(&blkg->blkcg_node) before getting
\na reference to the blkg. This is the same check used in blkg_destroy()
\nto detect if a blkg has already been destroyed. If the blkg is already
\nunhashed, skip processing it since it’s being destroyed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
blk-cgroup: skip dying blkg in blkcg_activate_policy()<\/p>\n
When switching IO schedulers on a block device, blkcg_activate_policy()
\ncan<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25734","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25734","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25734"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25734"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25734"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}