In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/resctrl: Prevent use-after-free in rdtgroup_kn_put()<\/p>\n
A struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that
\nneed the structure to remain valid across a sleep (while waiting on acquiring
\nrdtgroup_mutex) take a reference with rdtgroup_kn_get() and release it with
\nrdtgroup_kn_put().<\/p>\n
The release path is intended to serve as the fallback freer: if the count
\ndrops to zero and the group has already been marked RDT_DELETED,
\nrdtgroup_kn_put() frees the structure.<\/p>\n
The bulk teardown paths free_all_child_rdtgrp() and rmdir_all_sub() resulting
\nfrom a resctrl directory remove or resctrl fs unmount act as the primary
\nfreer: they hold rdtgroup_mutex and free each rdtgroup whose waitcount is
\nzero, otherwise they set RDT_DELETED and leave the freeing to the last waiter.<\/p>\n
These two freers race. rdtgroup_kn_put() commits waitcount == 0 with
\natomic_dec_and_test() outside rdtgroup_mutex, then reads rdtgroup::flags.
\nBetween those two operations a concurrent caller of free_all_child_rdtgrp()
\nor rmdir_all_sub() (which holds the mutex) can observe waitcount == 0 via
\natomic_read(), call rdtgroup_remove(), and kfree() the structure.<\/p>\n
The subsequent read of rdtgroup::flags in rdtgroup_kn_put() is then
\na use-after-free, and the structure may even be freed twice if the freed
\nmemory happens to satisfy the RDT_DELETED flag check.<\/p>\n
Replace the bare atomic_dec_and_test() with atomic_dec_and_mutex_lock() so
\nthat the decrement-to-zero takes rdtgroup_mutex before the count becomes
\nglobally visible. The inspection of rdtgroup::flags then runs under the same
\nmutex held by the bulk freers, making the two paths mutually exclusive.<\/p>\n
The common case where the count does not reach zero remains lock-free. Defer
\nkernfs_unbreak_active_protection() until after the mutex is dropped since
\nkernfs active protections functionally wrap rdtgroup_mutex. Remove resource
\ngroup, which in turn drops its kernfs reference, after kernfs protection is
\nrestored.<\/p>\n
[ bp: Split the commit messsages into smaller, easier-parseable paragraphs. ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/resctrl: Prevent use-after-free in rdtgroup_kn_put()<\/p>\n
A struct rdtgroup is reference counted via rdtgroup::waitcount. Callers th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25957","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25957","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}