In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
md: recheck spare changes before starting sync<\/p>\n
remove_spares() and remove_and_add_spares() modify the array’s rdev
\nconfiguration. These operations are only safe after the array has been
\nsuspended.<\/p>\n
md_start_sync() checks whether spare configuration changes are needed
\nbefore taking reconfig_mutex. However, the rdev state can change before
\nthe mutex is acquired, so the initial check can become stale. In that
\ncase, md_choose_sync_action() may remove or replace rdevs while normal
\nI\/O is still accessing them.<\/p>\n
The race can occur as follows:<\/p>\n
raid10d Worker Normal IO
\n____________ _______________________ ______________________<\/p>\n
raid10_write_request()
\n wait_blocked_dev()
\nset Blocked
\nset Faulty
\n Skip Faulty rdev
\n rrdev->nr_pending++
\n .repl_bio = bio
\n removeable_rdev = false .
\n array not suspended .
\nlock mddev goto err_handle
\n lock mddev (wait)
\n .
\nupdate sb .
\nclear Blocked .
\n .
\nunlock mddev .
\n lock mddev (acquires)
\n remove_spares()
\n removeable_rdev = true<\/p>\n
raid10_remove_disk()
\n rdev = replacement
\n replacement = NULL
\n rdev_dec_pending(NULL)
\n unlock mddev (NULL)->nr_pending–<\/p>\n
In this case, rdev_dec_pending() is called with a NULL pointer,
\nresulting in a NULL pointer dereference when attempting to decrement
\nnr_pending.<\/p>\n
Fix this by suspending the array when spare configuration changes are
\nneeded, including for non-read-write arrays, and checking again after
\ntaking reconfig_mutex. If the array was not already suspended and a
\nchange is now needed, release the mutex, suspend the array, and
\nreacquire the mutex before continuing.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
md: recheck spare changes before starting sync<\/p>\n
remove_spares() and remove_and_add_spares() modify the array’s rdev
\nconfiguration. <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25809","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25809","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25809"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25809"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25809"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}