In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dax\/fsdev: clear pgmap ops and owner on unbind<\/p>\n
fsdev_dax_probe() sets pgmap->ops = &fsdev_pagemap_ops and
\npgmap->owner = dev_dax, but nothing ever clears them. For a dynamic
\ndevice the pgmap is devm-allocated and freed on unbind, so this is
\nharmless. For a static device the pgmap is the shared, long-lived one
\nowned by the dax bus (kill_dev_dax() only NULLs dev_dax->pgmap for the
\nnon-static case), and device.c’s probe sets only pgmap->type, never
\nclearing ops\/owner.<\/p>\n
So after fsdev unbinds a static device the stale fsdev_pagemap_ops
\nsurvives on the shared pgmap. If the device is then rebound to
\ndevice_dax (MEMORY_DEVICE_GENERIC, which installs no ->memory_failure),
\nor the fsdev_dax module is unloaded, a subsequent memory_failure on that
\npgmap dispatches through the stale — and possibly freed — handler.<\/p>\n
Register a devm action that clears pgmap->ops and pgmap->owner on unbind,
\nsymmetric with setting them at probe, so the pgmap carries no fsdev state
\nonce fsdev is detached.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dax\/fsdev: clear pgmap ops and owner on unbind<\/p>\n
fsdev_dax_probe() sets pgmap->ops = &fsdev_pagemap_ops and
\npgmap->owner = dev_dax, <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25934","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25934","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25934"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25934"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25934"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}